Loading story…
Elastic Security Labs and Texas A&M University System Cybersecurity identified REF3927, an opportunistic, Chinese-speaking threat actor compromising Internet-facing IIS servers whose publicly disclosed ASP.NET machine keys permit ViewState deserialization attacks. The actor deploys Godzilla-derived webshells and GotoHTTP remote-management tooling, then attempts credential dumping and account creation. Researchers identified 571 actively infected IIS servers worldwide and found no confirmed victims in mainland China.
The campaign’s main payload, TOLLBOOTH, is a malicious IIS module offering a password-protected webshell, operator-management functions, SEO cloaking, link farming, and visitor redirection for monetization. The operators also use HIDDENDRIVER, a modified Hidden rootkit, to conceal processes, files, registry artifacts, and the driver itself through low-level Windows kernel manipulation. Defenders should fully remove malware and persistence mechanisms and rotate all exposed ASP.NET machine keys with newly generated values; incomplete cleanup has enabled recurring reinfections.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
Elastic Security Labs and Texas A&M University System Cybersecurity investigated REF3927 activity involving a Chinese-speaking actor exploiting ASP.NET ViewState deserialization on IIS servers whose ValidationKey and DecryptionKey values had been publicly disclosed. The opportunistic campaign used automated scanning and deployed Godzilla-derived webshells and GotoHTTP for post-compromise access.
Elastic Security published the Windows.Trojan.Tollbooth, Windows.Trojan.HiddenCli, and Windows.Trojan.HiddenDriver YARA rules covering malware used in the REF3927 campaign.
Researchers identified 571 IIS servers with active TOLLBOOTH infections across diverse industry sectors globally; no identified victim server was located in mainland China. They also observed reinfections of some remediated servers where exposed or reused ASP.NET machine keys had not been rotated.
In an observed intrusion, the actor deployed the TOLLBOOTH malicious IIS module, attempted credential dumping with Mimikatz, created an Administrator account, and attempted to deploy the HIDDENDRIVER kernel rootkit. Elastic Defend blocked the observed Mimikatz attempt and execution of TOLLBOOTH and HIDDENDRIVER.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 19 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
elastic.co
Open sourceasec.ahnlab.com
Open sourceuninformed.org
Open sourcelearn.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A Chinese-speaking cybercrime group, tracked as UAT-8099, has been identified targeting high-value Microsoft Internet Information Services (IIS) servers across multiple countries, including India, Thailand, Vietnam, Canada, and Brazil. The group’s primary objective is to conduct search engine optimization (SEO) fraud by manipulating search rankings through the compromise of reputable IIS servers. UAT-8099 leverages a variety of tools and techniques, including the deployment of BadIIS malware, web shells, open-source hacking utilities, and Cobalt Strike to maintain persistence and evade detection on compromised systems. The attackers use customized automation scripts to further obfuscate their activities and ensure continued access. Once inside a target server, the group exploits vulnerabilities to upload web shells, which are then used to collect sensitive information such as credentials, configuration files, logs, and certificate data. This stolen data is likely packaged for resale or used in further criminal operations. Cisco Talos researchers discovered several new BadIIS malware samples associated with this campaign, noting that some clusters had very low detection rates and others contained debug strings in simplified Chinese, indicating the group’s origin. The campaign has affected a diverse set of organizations, including universities, technology companies, and telecommunications providers, highlighting the group’s broad targeting strategy. UAT-8099’s operations are financially motivated, with a focus on monetizing both the manipulation of search engine results and the theft of valuable credentials. The group also utilizes Remote Desktop Protocol (RDP) to access and further exploit compromised IIS servers. The technical sophistication of the campaign is evident in the attackers’ ability to evade traditional security measures and maintain long-term persistence. The use of reputable, high-value servers for SEO fraud increases the impact of the campaign, as these servers are more likely to influence search engine rankings. The campaign demonstrates the ongoing threat posed by financially motivated cybercrime groups leveraging advanced malware and exploitation techniques. Security researchers recommend organizations running IIS servers implement robust monitoring, patch management, and incident response procedures to detect and mitigate such threats. The exposure of configuration files and certificates also raises concerns about potential follow-on attacks, including lateral movement and further credential abuse. The campaign’s discovery underscores the importance of threat intelligence sharing and proactive defense measures in protecting critical web infrastructure.
Jun 29, 2026
Cisco Talos reported a **late-2025 to early-2026** campaign attributed to China-linked **UAT-8099** targeting vulnerable **Microsoft Internet Information Services (IIS)** servers across Asia, with a notable concentration in **Thailand and Vietnam**. The actor uses **web shells** and **PowerShell** to run scripts and deploy the **GotoHTTP** remote-access tool, and has also been observed using **SoftEther VPN** and **EasyTier** to maintain control of compromised servers. The intrusions are used to deploy **BadIIS**, a malware family associated with **black-hat SEO/SEO fraud** activity. Talos assessed the activity as having significant operational overlap with WithSecure’s **WEBJACK** campaign, citing correlations across **malware hashes**, **C2 infrastructure**, **victimology**, and even the **gambling sites** being promoted. Talos also described **new BadIIS variants** that hardcode the intended target region and include customized behaviors (e.g., specific file extensions and directory indexing configurations), and noted the existence of a **Linux ELF** BadIIS variant previously uploaded to VirusTotal that supports multiple modes (including proxy, injector, and SEO-fraud).
Jun 29, 2026
Microsoft warned that attackers are actively using publicly disclosed ASP.NET `machineKey` values to achieve remote code execution on vulnerable IIS-hosted ASP.NET applications. The attacks abuse exposed static `validationKey` and `decryptionKey` values to generate malicious ViewState payloads with valid message authentication codes, allowing the ASP.NET runtime to accept and execute attacker-controlled data. Microsoft said the activity has been observed since at least December 2024 and linked some intrusions to deployment of the **Godzilla** post-exploitation framework. The company identified more than 3,000 leaked keys and released their hashes in a CSV file so organizations can check whether their environments are exposed. Guidance from Microsoft and CSIRT.SK urges defenders to replace any public or default keys, protect sensitive `web.config` elements through encryption, upgrade ASP.NET to at least version **4.8**, and further harden Windows and IIS servers to reduce the risk of malware deployment and follow-on compromise.
Jul 24, 2026