Hackers Use ASP.NET Machine Keys to Break Into IIS, Push Malicious Extensions
On Thu, Sep 25, 2025, the Texas A&M University System (TAMUS) Cybersecurity, in partnership with Elastic Security Labs, identified a sophisticated post-exploitation campaign conducted by a Chinese-speaking threat actor.
On Thu, Sep 25, 2025, the Texas A&M University System (TAMUS) Cybersecurity, in partnership with Elastic Security Labs, identified a sophisticated post-exploitation campaign conducted by a Chinese-speaking threat actor.
The attackers utilized a malicious IIS module named TOLLBOOTH, a Godzilla-forked webshell framework, the GotoHTTP remote monitoring and management tool, and a kernel-mode rootkit to maintain and conceal their presence. This threat group, designated REF3927, has impacted hundreds of servers globally across various industries.
The initial compromise was executed through deserialization attacks against the ASP.NET ViewState mechanism. Misconfigured IIS web servers exposed ASP.NET machine keys, allowing attackers to forge serialized payloads to execute arbitrary code.
A Base64-encoded ViewState payload generated by ysoserial.net triggered code execution, resulting in an HTTP 500 Internal Server Error on vulnerable servers. Recent investigations revealed the intrusion of a misconfigured Windows IIS server.
Post-compromise actions included deploying persistence and evasion tools such as the Godzilla-forked webshell framework, which provided in-memory assembly execution and encrypted communications. Attempts to create new Windows accounts failed, leading to the installation of the GotoHTTP RMM tool for control. Credential dumping attempts via Mimikatz were blocked by Elastic Defend.
This threat group, designated REF3927, has impacted hundreds of servers globally across various industries.
When interactive escalation was blocked, TOLLBOOTH was deployed. This traffic-hijacking IIS module retrieves configuration files from attacker-controlled infrastructure, implements SEO cloaking, and exposes a hardcoded webshell at /mywebdll . The module serves keyword-stuffed link farms to search crawlers and redirects users to malicious pages.
Collaboration with Validin identified 571 active TOLLBOOTH infections globally. The infections span multiple geographies and industries, indicating an automated exploitation strategy. Notably, no infections were found within mainland China, suggesting a geofencing tactic.
To remediate, it is crucial to restore affected servers by removing malware, modules, and rootkits, and to generate new, secure ASP.NET machine keys. Organizations should audit IIS configurations for reused machine keys, enable robust ViewState validation, and deploy endpoint detection solutions to alert on unauthorized activities.
The REF3927 campaign highlights the critical nature of configuration management. Defenders must prioritize secure machine key management, continuous monitoring, and hardened endpoint defenses to prevent similar exploits.
For further details, visit Elastic Security Labs .
Based on reporting by GBHackers.