Loading story…
More than 511,000 internet-exposed Microsoft IIS servers that have reached end-of-life are still accessible online, according to Shadowserver scan data cited by multiple reports. Of those, more than 227,000 have also moved beyond Microsoft’s Extended Security Updates window, leaving them fully out of support and ineligible for future critical patches. The largest concentrations of these obsolete IIS systems were identified in China and the United States, with Canada, France, Germany, Italy, the UK, Taiwan, South Korea, and Hong Kong each also reporting more than 10,000 exposed end-of-life servers.
Researchers warned that attackers routinely scan for unpatched edge infrastructure and web servers to exploit known vulnerabilities, gain initial access, and potentially support ransomware or APT operations. Shadowserver has begun labeling affected assets as eol-iis and eos-iis in its daily Vulnerable HTTP reports to help defenders find exposed systems. Recommended actions include auditing internet-facing assets, reviewing Shadowserver exposure data, upgrading or replacing legacy IIS and underlying Windows Server deployments, using ESU where still available, and isolating unavoidable legacy systems behind web application firewalls with tightly restricted access.
Map this exposure pattern across your cloud, code, and identities.
2 events from the most recent confirmed update back to the earliest known activity.
Following the findings, Shadowserver began labeling affected systems as "eol-iis" and "eos-iis" in its daily Vulnerable HTTP reports to help defenders identify exposed legacy IIS assets. The reporting highlighted especially high concentrations in China and the United States.
Shadowserver reported that its daily network scans on 2026-03-23 identified more than 511,000 internet-exposed Microsoft IIS instances that had reached end-of-life. Of these, more than 227,000 had also passed Microsoft's Extended Security Updates period, leaving them fully out of support.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See where this exposure pattern shows up across your cloud, code, supply chain, and non-human identities.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
ReliaQuest disclosed a newly tracked espionage cluster, **OP-512**, that targeted internet-facing Microsoft IIS servers running outdated software, including a compromised **Windows Server 2016** host using unsupported **.NET Framework 4.0**. Investigators said the actor likely maintained access for roughly 75 days before returning to deploy a custom three-file web shell framework designed to produce cryptographically unique installations, obscure forensic timelines through timestomping, and report its location back to operators through hex-encoded DNS queries with HTTP fallback. The intrusion relied on layered evasion and persistence, including randomized variable names, junk code, **RSA** signature verification, **RC4** encryption, and malicious DLLs stored in the ASP.NET temporary directory. OP-512 also loaded multiple privilege-escalation tools directly into IIS process memory, including several from the **Potato Suite** and an undocumented utility dubbed **GhostKit**; even when endpoint protection terminated malicious processes, IIS worker process restarts allowed the tooling to reload. ReliaQuest assessed the cluster with moderate-high confidence as China-linked and potentially related in tradecraft to other IIS-focused operations, while urging defenders to retire or isolate legacy .NET servers, restrict script execution in upload paths, and remediate the original access vector rather than only removing web shells.
Jun 29, 2026
A significant proportion of enterprise assets are currently running end-of-life (EOL) operating systems, posing a growing security risk as these systems no longer receive regular feature updates or bug fixes. According to research conducted by runZero, 8.56% of assets across hundreds of U.S. enterprises are operating on EOL systems, with 5% already beyond extended support and thus missing critical security patches. The prevalence of these unsupported systems is particularly high in industries such as retail, machinery, electronics manufacturing, healthcare, and social services, where legacy applications are often essential for core business functions. In healthcare and social services, the use of unsupported operating systems can directly impact patient safety due to their integration with critical care applications. The situation is set to worsen dramatically with the upcoming end-of-life date for Windows 10 on October 14, 2025. After this date, approximately one-third of all enterprise Windows assets will lose official support, causing the overall percentage of EOL systems in enterprises to surge from 5% to around 16%. This transition, referred to as the 'Winpocalypse,' will disproportionately affect sectors already struggling with legacy dependencies, especially healthcare and social services, which are expected to see the steepest increases in exposure. Many organizations remain reliant on Windows 10 and earlier versions due to business-critical applications that cannot be easily migrated or upgraded. The persistence of these 'undead' systems is often due to forgotten servers or specialized equipment, such as medical devices, that are incompatible with newer operating systems. Attackers exploit these vulnerabilities by using network reconnaissance to identify and compromise outdated systems, which are often overlooked in standard security assessments. Internet scans reveal only a portion of the risk, as many legacy systems are not directly exposed but remain accessible to attackers who have breached the network perimeter. Security experts emphasize the need for organizations to establish a baseline inventory of EOL systems and to assess their unique risk profiles, rather than assuming complete eradication of unsupported assets is feasible. The looming Windows 10 deadline has prompted renewed calls for enterprises to accelerate migration plans and to implement compensating controls where immediate upgrades are not possible. Failure to address the growing population of EOL systems will significantly expand the attack surface available to cybercriminals, increasing the likelihood of successful breaches. The research underscores the urgency for proactive asset management, regular vulnerability assessments, and strategic planning to mitigate the risks associated with legacy operating systems. Organizations are advised to prioritize the replacement or isolation of unsupported systems, especially those integral to critical business operations. The findings highlight the intersection of operational necessity and cybersecurity risk, illustrating the complex challenges enterprises face in balancing legacy support with modern security requirements. As the Windows 10 end-of-life approaches, the need for comprehensive risk management strategies becomes ever more pressing for organizations across all sectors.
Jun 29, 2026
A long-lived **Redis** memory-corruption flaw dubbed **RediShell** (`CVE-2025-49844`) was reported as a *use-after-free* bug that can lead to **remote code execution** under certain conditions. Although exploitation requires authentication, research noted that tens of thousands of Redis instances have historically been exposed to the internet without authentication enabled, increasing real-world risk; the issue was discovered by **Wiz** and demonstrated at *Pwn2Own Berlin* prior to public disclosure. Separately, **IceWarp** disclosed a critical **unauthenticated RCE** (`CVE-2025-14500`) caused by **OS command injection** in handling of the `X-File-Operation` HTTP header, impacting both Windows and Linux deployments and enabling arbitrary command execution as **SYSTEM/root**. The flaw was reported in September 2025 and fixed in October 2025 across supported product lines, but **Shadowserver** reported more than **1,200** internet-facing on-prem instances still unpatched and said it is notifying affected owners to upgrade.
Jun 29, 2026