China-Linked OP-512 Targets IIS Servers With Unique Web Shell Framework

A suspected China-linked espionage cluster dubbed OP-512 after rapidly correlating many low-fidelity events into a single high-priority incident that human analysts then validated.

OP-512 compromised an Internet Information Services (IIS) server and deployed a custom web shell framework built to evade signature-based detection.

Each web shell instance is cryptographically unique, restricts access with layered encryption, and automatically reports its location back to attacker infrastructure, making this operation both persistent and stealthy.

The intrusion targeted an internet-facing Windows Server running end-of-life .NET Framework 4.0. Evidence indicates the attacker had intermittent access for at least 75 days before returning to stage a concentrated escalation.

Within hours of re-entry, the actor dropped three web shells: an .aspx file manager that self-reported its URL via DNS and HTTP fallback, and two .ashx command handlers that require RSA signature verification and RC4 encryption to accept commands.

The .aspx shell phones home by encoding its path into hex-segmented subdomains in DNS queries; if that channel fails, it sends the same encoded path in an HTTP request.

This dual notification design allows the operator to deploy and then rely on automated discovery, reducing the need for further interactive reconnaissance.

Crucially, each web shell deployment is uniquely generated by an automated builder that randomizes variable names, injects junk code, and embeds different RSA public keys, so file hashes and static indicators differ across incidents.

ReliaQuest’s Agentic AI surfaced a suspected new China-linked espionage cluster, “OP-512,” by correlating a high volume of seemingly unrelated events at machine speed.

The command handlers verify signed, encrypted payloads before execution, preventing defenders from issuing commands and complicating network-level inspection.

OP-512 Targets IIS Servers

The web shells also timestomp file timestamps to blend into existing file timelines, and they force ASP.NET to compile artifacts that persist in temporary directories compiled DLLs that can outlive deleted source files and re-enable access if not removed.

The RC4 decryption function from both handlers. The algorithm is identical, but every variable and method name has been randomized.

After deployment, the attacker loaded multiple post-exploitation toolkits directly into the IIS worker process memory, including several “Potato” privilege escalation tools.

These ran without writing disk artifacts, and although endpoint protection terminated the malicious process, IIS automatically restarted its worker process, allowing the attack to recover and continue.

Detection relied on EDR telemetry that flagged reflective .NET assembly loading; without behavioral telemetry, the intrusion would likely have remained hidden.

ReliaQuest notes OP-512 is at least the fourth China-linked cluster observed targeting legacy IIS servers in the past year, but it stands apart because of its per-deployment cryptographic uniqueness and robust operational security.

Some overlap exists with prior clusters most notably rare hex-encoded DNS signaling seen in CL-STA-0048 but OP-512’s tooling, infrastructure, and encrypted command model suggest either a distinct actor or a significant retooling of an existing group.

Defenders should treat this as an urgent call to retire or isolate end-of-life .NET frameworks on internet-facing hosts, harden upload directories and ASP.NET compilation paths, and prioritize behavioral detection over signature hunting.

Practical steps include isolating suspected hosts immediately to prevent automatic IIS restarts from reestablishing access, monitoring outbound DNS for long hex-segmented subdomains from w3wp.exe, and clearing ASP.NET temporary compilation artifacts after removing web shells.

For further reading and context, see ReliaQuest’s technical write-up on OP-512 and their related blog on China-linked espionage operations and the ArcGIS “Flax Typhoon” compromise, which illustrates similar shared tooling and tradecraft.

Rapid correlation of small events into a single incident as demonstrated by GreyMatter Agentic AI materially shortens the window attackers depend on and is critical for containing sophisticated, patient espionage operations like OP-512.

IOCs

Artifact	Details
ashx.lhlsjcb[.]com	DNS C2 domain observed during earlier activity on the same host, approximately 75 days before the primary incident. The use of a different domain from the later intrusion (hcgos[.]com) suggests infrastructure rotation between visits.
hcgos[.]com	DNS C2 domain used by the self-reporting notification channel. In logs, look for the subdomain pattern a.<hex>.c.hcgos[.]com.
43.160.202[.]246:8053	Meterpreter C2 server on non-standard port.
140.206.161[.]227:443	Outbound connection from compromised host.
124.156.129[.]151	Source IP for web shell interaction. High-signal due to the combination of python-requests/2.33.0 user agent, POST requests to upload paths containing .aspx files, and timing aligned with the web shell deployment window. The user agent alone is not a reliable indicator.

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.