Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
3 IOCs
China-Linked OP-512 Targets IIS Servers With Unique Web Shell Framework
Excerpt
A newly identified China-linked threat cluster, dubbed OP-512, is targeting Internet Information Services (IIS) servers using a highly evasive custom web shell framework. Discovered by ReliaQuest, this espionage operation stands out in an increasingly crowded attack surface. OP-512 marks at least the fourth China-aligned group to compromise IIS servers in the past year, but its sophisticated tooling easily bypasses standard endpoint defenses. The attackers breached a legacy…
Read the original report →Diamond Model
Adversary
Infrastructure(3)
Capability
Victim
Indicators of Compromise
Open the mindmap →3 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | hcgos.com | High | Score 63/100 | First seen |
| Domain | ashx.lhlsjcb.com | High | Score 68/100 | First seen |
| Domain | c.hcgos.com | High | Score 63/100 | First seen |
IOC Relationship Graph
Building graph…