Loading story…
Microsoft warned that attackers are actively using publicly disclosed ASP.NET machineKey values to achieve remote code execution on vulnerable IIS-hosted ASP.NET applications. The attacks abuse exposed static validationKey and decryptionKey values to generate malicious ViewState payloads with valid message authentication codes, allowing the ASP.NET runtime to accept and execute attacker-controlled data. Microsoft said the activity has been observed since at least December 2024 and linked some intrusions to deployment of the Godzilla post-exploitation framework.
The company identified more than 3,000 leaked keys and released their hashes in a CSV file so organizations can check whether their environments are exposed. Guidance from Microsoft and CSIRT.SK urges defenders to replace any public or default keys, protect sensitive web.config elements through encryption, upgrade ASP.NET to at least version 4.8, and further harden Windows and IIS servers to reduce the risk of malware deployment and follow-on compromise.
See which actors are running it and whether you're in range.
2 events from the most recent confirmed update back to the earliest known activity.
On February 6, 2025, Microsoft warned that attackers were using exposed ASP.NET machine keys for code injection attacks and said it had identified more than 3,000 leaked keys. Microsoft also published hashes of the discovered keys in a CSV file to help organizations identify exposure.
Microsoft reported that threat actors had been actively abusing publicly disclosed ASP.NET machine keys since at least December 2024 to achieve remote code execution against vulnerable ASP.NET applications. Observed post-compromise activity included deployment of malware and use of the Godzilla framework.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Elastic Security Labs and Texas A&M University System Cybersecurity identified **REF3927**, an opportunistic, Chinese-speaking threat actor compromising Internet-facing IIS servers whose publicly disclosed ASP.NET machine keys permit ViewState deserialization attacks. The actor deploys Godzilla-derived webshells and GotoHTTP remote-management tooling, then attempts credential dumping and account creation. Researchers identified 571 actively infected IIS servers worldwide and found no confirmed victims in mainland China. The campaign’s main payload, **TOLLBOOTH**, is a malicious IIS module offering a password-protected webshell, operator-management functions, SEO cloaking, link farming, and visitor redirection for monetization. The operators also use **HIDDENDRIVER**, a modified Hidden rootkit, to conceal processes, files, registry artifacts, and the driver itself through low-level Windows kernel manipulation. Defenders should fully remove malware and persistence mechanisms and rotate all exposed ASP.NET machine keys with newly generated values; incomplete cleanup has enabled recurring reinfections.
Sep 9, 2026
Google Cloud's Mandiant Threat Intelligence reported exploitation of the KnowledgeDeliver platform through an ASP.NET **ViewState deserialization vulnerability**, indicating attackers were able to abuse insecure server-side handling of serialized state data to achieve code execution on exposed systems. The issue affects deployments where ViewState protections were improperly configured or bypassed, turning a common web application mechanism into an entry point for compromise. The report highlights the risk to organizations running internet-facing KnowledgeDeliver instances, where successful exploitation could allow unauthorized access, remote command execution, and follow-on intrusion activity. Defenders were urged to identify exposed systems, review application and web server logs for suspicious requests tied to ViewState processing, validate hardening of ASP.NET cryptographic settings, and apply vendor guidance or mitigations to prevent further exploitation.
Jul 12, 2026
**CVE-2024-46938** is an order-of-operations flaw affecting Sitecore CMS 8.x through 10.x that allows unauthenticated attackers to read arbitrary local files when they know, or can infer, the product’s absolute installation path. Attackers can use the issue to retrieve sensitive files such as `web.config` and Sitecore backup files, exposing application secrets. Disclosed ASP.NET machine keys or Telerik encryption keys can be leveraged for .NET ViewState deserialization and ultimately remote code execution. Sitecore addressed the issue in August 2024 in Security Bulletin **SC2024-001-619349**, but internet-exposed deployments may remain susceptible if unpatched; organizations should apply the vendor update and assess exposed instances for secret disclosure and potential compromise.
Sep 3, 2026