THREAT INTELLIGENCE REPORT

OP-512: China-Linked Threat Cluster Targeting Microsoft IIS Servers

Technical analysis of the OP-512 espionage campaign leveraging a custom IIS web shell framework, stealth techniques, privilege escalation, and centralized attacker infrastructure targeting exposed Microsoft IIS servers.

Threat Actor
OP-512
Target Platform
Microsoft IIS
Campaign Type
Cyber Espionage
Report Date
21 June 2026

Executive Summary

Security researchers identified a previously undocumented threat cluster known as OP-512 targeting Microsoft Internet Information Services (IIS) servers. The threat actor deploys a custom web shell framework designed for persistence, stealth, remote command execution, and centralized management of compromised systems.

The activity demonstrates characteristics commonly associated with China-linked cyber espionage operations. OP-512 employs advanced anti-forensic techniques, cryptographic access controls, timestamp manipulation, and privilege escalation methods to maintain long-term access within victim environments.

Key Finding: OP-512 utilizes uniquely generated web shells and automated self-reporting mechanisms, making traditional signature-based detections significantly less effective.

Threat Overview Metrics

Threat Level

High

Motivation

Espionage

Target

IIS Servers

Attribution

China-Linked

Persistence

Custom Web Shells

Privilege Escalation

Potato Suite

Threat Actor Profile

Attribute Details
Threat Cluster OP-512
Assessment Moderate to High Confidence China-Linked Activity
Primary Objective Cyber Espionage
Primary Targets Internet-Facing IIS Servers
Infrastructure Attacker-Controlled DNS and HTTP Infrastructure
Notable Capability Custom Web Shell Framework

Attack Timeline

Initial Reconnaissance

Threat actor activity observed approximately 75 days before the primary intrusion event through suspicious DNS communications.

Web Shell Deployment

IIS worker process (w3wp.exe) used to deploy a custom web shell into the application upload directory.

Automated Beaconing

Compromised server automatically reports web shell location through DNS queries or HTTP fallback communication.

Privilege Escalation

Potato Suite tools executed to elevate privileges to SYSTEM level.

Post-Exploitation

Threat actor executes system reconnaissance commands and establishes persistent access.

Technical Analysis

Custom Web Shell Framework

OP-512 deploys three interconnected web shells that collectively provide file management, command execution, persistence, and automated reporting.

Capability Description
Remote Command Execution Execute commands on compromised systems
File Management Upload, modify, and delete files
Self Reporting Automatically notify attacker infrastructure
Authentication Controls Cryptographic access restrictions
Persistence Maintain long-term server access
Advanced Feature: Each web shell deployment is uniquely generated, reducing the effectiveness of IOC-based detections.

Defense Evasion Techniques

Detection Challenge: Timestamp manipulation can cause malicious files to appear months older, complicating forensic investigations and timeline reconstruction.

Observed Commands and Activities

Activity Purpose
w3wp.exe Deploy web shell components
whoami /priv Verify elevated privileges
DNS Beaconing Report compromise status
HTTP Fallback Communication Alternative attacker communication
Potato Suite Privilege Escalation

Indicators of Compromise (IOCs)

Type Indicator
Domain ashx.lhlsjcb[.]com
Process w3wp.exe
Technique Timestomping
Tool Potato Suite
Target Microsoft IIS Servers
Critical Alert: Internet-facing IIS servers running unsupported software versions are considered high-risk assets and should be prioritized for investigation.

MITRE ATT&CK Mapping

Tactic Technique ID
Persistence Server Software Component Web Shell T1505.003
Defense Evasion Timestomp T1070.006
Execution Command and Scripting Interpreter T1059
Privilege Escalation Exploitation for Privilege Escalation T1068
Command and Control Application Layer Protocol T1071

Detection and Mitigation Recommendations

  1. Upgrade unsupported IIS and .NET environments immediately.
  2. Monitor IIS upload directories for unauthorized files.
  3. Enable advanced PowerShell and process auditing.
  4. Inspect DNS traffic for unusual beaconing activity.
  5. Implement EDR solutions with behavioral detection.
  6. Restrict web server privileges wherever possible.
  7. Monitor w3wp.exe child process execution.
  8. Review timestamp anomalies on web application files.
Best Practice: Deploy application allow-listing and web server integrity monitoring to detect unauthorized web shell deployment attempts.

References