REF3927

REF3927, also known as RudePanda, is a Chinese-speaking, financially motivated threat cluster conducting opportunistic compromises of internet-exposed Windows IIS and ASP.NET servers. The actor abuses publicly disclosed or reused ASP.NET machine keys to forge ViewState payloads and achieve code execution through ViewState deserialization. Its operations have affected IIS servers globally across diverse sectors, consistent with automated scanning for exposed machine-key reuse rather than sector-specific targeting. Following access, REF3927 deploys Godzilla-derived webshells, uses GotoHTTP remote-management tooling, attempts account creation and credential dumping, and seeks to establish durable access. The group has also attempted to use HIDDENDRIVER, a modified Hidden rootkit-derived kernel driver that uses DKOM, kernel callbacks, filesystem filtering, and registry callbacks to conceal processes, files, directories, and registry artifacts and to restrict access to protected processes. REF3927's principal monetization payload is TOLLBOOTH, a malicious native and managed IIS module that combines a password-protected webshell and operator-management functions with SEO cloaking, link farming, page hijacking, visitor fingerprinting, and conditional redirection. TOLLBOOTH differentiates search-engine crawlers from ordinary visitors, serves crawler-oriented keyword content, and redirects human visitors to attacker-selected destinations. Incomplete remediation, particularly failure to replace exposed ASP.NET machine keys, has enabled reinfection of compromised servers.