A newly reported threat cluster called OP-512 has been observed targeting Microsoft IIS servers using a custom web shell framework. The activity is linked to China-aligned cyber espionage operations and focuses on maintaining stealthy remote access inside compromised environments. The attackers reportedly use multiple web shells, cryptographic access controls, timestomping, and centralized reporting to manage compromised servers while reducing the chance of detection. Very considerate of them to build enterprise-grade tooling for criminal persistence. 

Why this matters 

Microsoft IIS servers are often exposed to the internet and commonly host business applications, portals, APIs, and internal services. If attackers gain access to an IIS server, they may be able to run commands, upload additional tools, steal data, move laterally, or use the server as a long-term foothold.

The use of a custom web shell framework is especially concerning. Web shells are not just one-time access tools. They allow attackers to quietly return, issue commands, hide activity, and maintain control even after the initial intrusion path is closed. In this case, the framework reportedly includes individually generated deployments and cryptographic controls, making it harder for defenders to detect using simple indicators alone. 

What organizations should watch for 

Organizations running IIS should inspect web directories for unknown ASPX, ASP, DLL, or script files, especially recently added or oddly timestamped files. Timestomping can make malicious files appear older or blend with legitimate files, so file creation dates alone should not be trusted. Because apparently even timestamps now lie for a living.

Security teams should review IIS logs, Windows event logs, web server access patterns, unusual POST requests, suspicious user agents, unexpected command execution, and outbound connections from web servers. Any IIS server making unexplained external connections deserves attention, especially if it is contacting unfamiliar infrastructure.

What should be done 

IIS servers should be fully patched, hardened, and restricted to only required modules and services. Web application vulnerabilities should be tested regularly, especially upload functions, authentication flows, admin panels, and exposed APIs.

Organizations should also apply file integrity monitoring, EDR coverage, least-privilege service accounts, application pool isolation, and strict outbound firewall rules. Web servers should not have broad internal access just because someone once found it convenient during deployment and then wandered away from responsibility.

Security takeaway 

OP-512 shows that attackers continue to target internet-facing web infrastructure as a reliable entry point into organizations. The use of custom web shells and stealth techniques makes this more than a simple compromise. It is about durable access, quiet control, and long-term espionage.

The practical message is clear: monitor IIS servers closely, inspect for web shells, restrict outbound access, validate file integrity, and investigate unusual server behavior quickly. A web server is not just a hosting platform. Once compromised, it can become an attacker’s command post inside the network.

Cybersecurity researchers have discovered a previously unreported threat cluster dubbed OP-512 that has been observed targeting Microsoft Internet Information Services (IIS) servers to deploy a bespoke web shell framework. ReliaQuest has assessed with moderate to high confidence that the espionage-focused activity is linked to China. "OP-512 was highly likely conducting espionage through a

Source: New Threat Cluster OP-512 Targets Microsoft IIS Servers with Custom Web Shell Framework via The Hacker News — published 05 Jun 2026.