ASPX Web Shell Upload from Known OP-512 Infrastructure

Kaung Khant Ko@kaungkhantko

•updated Jun 9, 2026•1•0•4

Detects the upload of an ASPX web shell originating from a specific IP address (124.156.129.151) associated with the OP-512 threat group. The detection specifically looks for POST requests to .aspx endpoints with a user agent containing 'python-requests/2.33.0' in IIS logs.