OP-512 Targets IIS Servers with Custom Web Shell Framework

Researchers discovered threat cluster OP-512 targeting Microsoft IIS servers with a custom web shell framework for espionage. ReliaQuest assessed with moderate to high confidence the activity is linked to China. The framework uses three web shells that evade detection by timestomping, manipulating timestamps to appear as if they have been present for some time. OP-512 is the fourth threat group targeting IIS servers in the past 12 months.