Hackers Abuse ASP.NET Machine Keys to Compromise IIS Servers and Deploy Malicious Modules

ASP.NET Machine Keys Vulnerability Exploited

A recent hacking campaign has been identified where attackers utilized publicly accessible ASP.NET machine keys to compromise Windows IIS web servers . These keys, intended to safeguard web applications, were discovered in locations such as Microsoft documentation and online forums, enabling attackers to execute malicious code on targeted servers.

The threat group, designated as REF3927, deployed a malicious tool named TOLLBOOTH, which redirects traffic to inflate search rankings fraudulently.

Attackers initially locate IIS servers with inadequate configurations where ASP.NET machine keys, essential for encrypting user data, are sourced from public repositories instead of being newly generated. These keys are crucial for securing elements such as ViewState, which maintains user input across web page interactions.

Upon key exposure, attackers can forge a ViewState message containing malicious code, enabling command execution on the server via a web request. Subsequently, attackers deploy a webshell derived from the Godzilla tool , allowing them to execute commands, extract passwords, and conduct network scans while disguising traffic as legitimate web communications.

Efforts to create administrative accounts and extract additional credentials using Mimikatz were partially thwarted by defenses such as Elastic. A modified rootkit from the open-source project Hidden was employed to conceal files, processes, and registry entries within the system.

The TOLLBOOTH tool acts as an IIS add-on that obscures malicious content from search engines while presenting irrelevant content to regular users. It analyzes browser details to deliver keyword-heavy pages to bots like Googlebot, artificially improving search rankings and directing traffic to deceptive sites. TOLLBOOTH also includes a built-in webshell for file uploads and command execution, alongside debugging tools for monitoring server status.

Settings are retrieved from a control server at c[.]cseo99.com, with confidential data stored in temporary directories on the compromised machine. In one instance, a prompt response from Texas A&M’s team during managed detection services prevented a full-scale breach.

The campaign targeted servers globally, excluding China, impacting various sectors from finance to technology. Many servers experienced reinfection post-cleanup, as machine keys remained unchanged, leaving vulnerabilities unaddressed. Administrators are advised to regenerate machine keys in IIS, eradicate malware, and monitor for unusual web traffic or new modules.

Based on reporting by Cyber Security News.