Loading threat actor…
OP-512 is a newly documented cyberespionage cluster assessed with moderate to high confidence to be linked to China. The actor has been observed targeting Microsoft Internet Information Services (IIS) servers, particularly legacy or unsupported environments, to establish stealthy, long-term access for intelligence collection. Reported activity centers on compromised Windows Server 2016 IIS infrastructure running outdated .NET components, indicating a preference for exposed web infrastructure with weak defensive coverage. The group uses a bespoke multi-component web shell framework that provides remote access, file management, authenticated command execution through multiple channels, and centralized reporting of newly established footholds. Its tooling is designed for evasion and operational resilience: deployments are cryptographically unique, access is protected with cryptographic controls, payloads use encrypted communications, and generated samples vary through randomized variable names and junk code, reducing the value of signature-based detection. OP-512 also employs timestomping to blend malicious artifacts with legitimate files and complicate forensic reconstruction. Observed tradecraft includes persistence through malicious components associated with the IIS application environment, self-reporting of deployed web shells through encoded DNS queries with HTTP fallback, and in-memory loading of privilege-escalation tooling rather than writing tools to disk. The actor has used components of the Potato Suite to attempt escalation to SYSTEM and has demonstrated post-exploitation command execution and long-dwell access. In at least one intrusion, defensive process termination was insufficient because IIS worker process restarts allowed malicious tooling to reload, underscoring the actor’s focus on durable access. OP-512 is tracked as distinct from, but tactically proximate to, other China-linked IIS-focused activity clusters including CL-STA-0048, DragonRank, and GhostRedirector. Available reporting characterizes it as part of a broader China-linked ecosystem that repeatedly targets internet-facing IIS servers for espionage operations. Known aliases are limited to OP-512.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Attributed origin per open-source reporting.
13 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
1 malware family attributed to this actor across reporting.
6 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
China-linked espionage cluster targeting IIS servers using a custom web shell framework with cryptographically unique deployments, self-reporting web shell location via DNS with HTTP fallback, in-memory privilege escalation tooling, and anti-detection measures such as timestomping and randomized code generation.
A likely China-linked espionage cluster conducting long-term intelligence-gathering via a compromised IIS web server, using a custom web shell framework with cryptographically unique payloads, encrypted access controls, centralized management, persistent access, privilege escalation, and multiple command channels.
A newly identified espionage cluster suspected of having ties to China that targets Internet Information Services (IIS) web servers using a custom, cryptographically unique web shell framework, in-memory privilege escalation tooling, and persistence techniques designed to evade detection and survive process restarts.
Espionage-focused activity cluster targeting Microsoft IIS servers using a custom multi-component web shell framework for remote access and defense evasion.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.