Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
6 IOCs
China-Linked Group Deploys Custom ASPX and ASHX Web Shells
Malware Families
Excerpt
A previously undocumented China-linked espionage cluster, tracked as OP-512, has been caught deploying a purpose-built web shell framework against Internet Information Services (IIS) servers . ReliaQuest identified and validated the cluster after its Agentic AI correlated dozens of low-fidelity events across a customer environment into a single high-priority incident at machine speed. The compromised server running Windows Server 2016 with…
Read the original report →Diamond Model
Adversary
Infrastructure(6)
Capability(3)
Victim
Indicators of Compromise
Open the mindmap →6 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| IP | 124.156.129.151 | High | Score 64/100 | First seen |
| Domain | hcgos.com | High | Score 63/100 | First seen |
| Domain | ashx.lhlsjcb.com | High | Score 68/100 | First seen |
| Domain | c.hcgos.com | High | Score 63/100 | First seen |
| IP | 140.206.161.227 | High | Score 58/100 | First seen |
| IP | 43.160.202.246 | High | Score 64/100 | First seen |
IOC Relationship Graph
Building graph…