Executive Summary
A China-linked espionage cluster identified as OP-512 has been observed deploying a sophisticated web shell framework specifically designed for Internet Information Services (IIS) servers. The campaign targeted environments running end-of-life .NET Framework versions, establishing persistence for over 70 days. This cluster is one of several China-aligned groups, including DragonRank and GhostRedirector, focusing on perimeter IIS infrastructure to maintain long-term network access.
The technical tradecraft of OP-512 is characterized by high operational security, utilizing RSA-signed and RC4-encrypted communication channels. The group employs advanced anti-forensic measures like automated timestomping and memory-only execution of privilege escalation utilities to bypass disk-based detection. The persistence of their tooling is reinforced by the native IIS auto-restart feature, which can re-inject in-memory implants even after process termination by security software.