Loading story…
A threat actor repeatedly exploited or attempted to exploit a vulnerable Adobe ColdFusion server, then used IIS worker process w3wp.exe to run reconnaissance and deploy multiple steganographic webshells, including UA4fp7R.aspx and WRBYTR5750images.aspx. Huntress reported the intruder embedded the marker ONEPIECE in shell logic and maintained persistence across repeated restoration attempts, indicating the server was returned to production before remediation was complete.
The intrusion escalated into broad defense impairment designed to preserve access and obstruct responders. The actor timestomped files, disabled IIS logging and Microsoft Defender, killed security and logging tools, removed the ModSecurity IIS module, and used Image File Execution Options debugger registry entries to neutralize Sysmon and Filebeat. The attacker also weakened credential protections by enabling WDigest UseLogonCredential, exported ODBC registry data, and used Mimikatz-style credential dumping to write passwords and hashes to files before Huntress disrupted the operation prior to data theft or ransomware deployment.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Huntress reported that its SOC ultimately disrupted the intrusion before data exfiltration or ransomware encryption occurred. The incident was later described publicly in Huntress's June 29, 2026 blog post.
The threat actor exported ODBC registry data, enabled WDigest UseLogonCredential, and used tools associated with Mimikatz-style credential dumping to write passwords and hashes to files. These actions were part of the broader post-compromise activity on the server.
After the server was prematurely returned to service twice, the attacker intensified activity to preserve access and hinder investigation. Actions included timestomping files, disabling IIS logging and Microsoft Defender, killing logging and security tools, uninstalling the ModSecurity IIS module, and using IFEO registry debugger entries against Sysmon and Filebeat.
During the intrusion, the actor uploaded multiple webshells including UA4fp7R.aspx and WRBYTR5750images.aspx. Huntress said the shell logic contained the string ONEPIECE as an operational marker.
In June 2024, a threat actor repeatedly exploited or attempted to exploit a vulnerable Adobe ColdFusion server during a web server intrusion. The attacker used the IIS worker process w3wp.exe to launch reconnaissance commands after gaining access.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A threat actor exploited an **SQL injection** flaw in a web page at a technology-sector organization, compromising an endpoint running **IIS** and **Microsoft SQL Server** and then carrying out extensive post-exploitation activity. Huntress reported the attacker used **base64-encoded PowerShell** for payload delivery, ran reconnaissance including `tasklist /svc`, and exfiltrated process information to an **OAST** domain. The actor then enabled **Remote Desktop Services**, created a new local administrator account named `adminweb2$`, and attempted to disable **Windows Defender** to retain access and reduce detection. The intrusion escalated into broad persistence and monetization efforts on the same host. The attacker installed known **BadIIS** modules using `appcmd.exe`, downloaded the **XMRig** cryptocurrency miner, hid miner-related files with `attrib.exe`, and used `nssm.exe` to keep the miner running persistently. Additional payloads included PowerShell and batch files such as `qdcjoke1.2.ps1`, `c_joke1.2.ps1`, and `qd_tjoke.bat`, along with **CnCrypt Protect**, likely for defense evasion. Huntress said the case stood out for the volume of system changes made after the initial compromise and warned that remediation must address the original SQL injection weakness to prevent re-entry.
Jul 13, 2026
Attackers turned a single **ClickFix** social-engineering lure into a multi-stage Windows intrusion that abused `pcalua.exe` to launch `mshta.exe`, retrieve an HTA payload, and install malware that progressed through loaders and remote-access tooling. Reporting describes a chain involving **EtherHiding** infrastructure and **GULoader**, while Huntress documented a related intrusion in which an MSI dropped **Potemkin**, a custom x64 loader that used a deterministic 10,000-domain DGA to find command-and-control servers and reflectively load a follow-on DLL called **RMMProject** entirely in memory. RMMProject provided browser credential and cookie theft, a Chrome App-Bound Encryption bypass via helper DLL injection, hidden-desktop remote control, process injection, screenshot capture, and runtime module loading. The operators then established persistence with Run keys, scheduled tasks, and a renamed **Cloudflare Tunnel**, and deployed **EtherRAT**, a Node.js backdoor that resolved its C2 from an Ethereum smart contract. Huntress said the attackers conducted hands-on-keyboard activity, repeatedly battled Microsoft Defender, attempted to deploy **Chisel** reverse SOCKS tunnels, and used **WinRM**, **WMIExec**, and **SMBExec** for lateral movement, spreading EtherRAT to more than 11 hosts including the domain controller. The intrusion showed how an unmonitored initial endpoint allowed hours of attacker activity before defenders had telemetry, enabling a single user action to escalate into a network-wide compromise.
Jul 12, 2026
ReliaQuest disclosed a newly tracked espionage cluster, **OP-512**, that targeted internet-facing Microsoft IIS servers running outdated software, including a compromised **Windows Server 2016** host using unsupported **.NET Framework 4.0**. Investigators said the actor likely maintained access for roughly 75 days before returning to deploy a custom three-file web shell framework designed to produce cryptographically unique installations, obscure forensic timelines through timestomping, and report its location back to operators through hex-encoded DNS queries with HTTP fallback. The intrusion relied on layered evasion and persistence, including randomized variable names, junk code, **RSA** signature verification, **RC4** encryption, and malicious DLLs stored in the ASP.NET temporary directory. OP-512 also loaded multiple privilege-escalation tools directly into IIS process memory, including several from the **Potato Suite** and an undocumented utility dubbed **GhostKit**; even when endpoint protection terminated malicious processes, IIS worker process restarts allowed the tooling to reload. ReliaQuest assessed the cluster with moderate-high confidence as China-linked and potentially related in tradecraft to other IIS-focused operations, while urging defenders to retire or isolate legacy .NET servers, restrict script execution in upload paths, and remediate the original access vector rather than only removing web shells.
Jun 29, 2026