Anomalous Outbound Connection Initiated by w3wp.exe (C2/Exfil Beaconing) (CVE-2026-45659 command-and-control or staging for ransomware deployment)

Ankit Mehta@Secvyn

•updated Aug 11, 2026•2•0•2

Detects outbound network connections initiated by the Internet Information Services (IIS) worker process (w3wp.exe) to non-Microsoft IP addresses on suspicious or high-range ports. This behavior often indicates compromised web servers being used for command-and-control (C2) communication, reconnaissance, or data exfiltration.