OP-512 is a newly identified China-linked espionage cluster targeting legacy IIS servers. It uses a custom web shell framework composed of three components: a file manager with a command-and-control notification channel and two cryptographically authenticated command handlers. Each deployment is cryptographically unique, employing RSA and RC4 encryption alongside timestomping techniques to avoid signature-based detection. The attackers maintained persistence for 75 days before rapidly deploying multiple access paths and privilege escalation tools including BadPotato, SweetPotato, and EfsPotato. The framework establishes dual notification channels via DNS and HTTP, using hex-encoded subdomain queries for self-reporting and automated builder-generated code with randomized variables. There are no known exploits in the wild, and no patch or official remediation guidance is currently available.

The OP-512 cluster enables attackers to maintain long-term persistence on targeted IIS servers, deploy multiple access paths, and escalate privileges using known tools. The use of cryptographic uniqueness and timestomping techniques complicates detection and forensic analysis. This can lead to unauthorized access, data exfiltration, and potential further compromise of affected systems. However, there are no confirmed reports of widespread exploitation or active incidents at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Organizations should monitor for indicators of compromise such as the provided IP addresses, domains, and URLs associated with OP-512. Given the use of privilege escalation tools and web shells, restricting unnecessary IIS server exposure and applying best practices for server hardening are advisable. No official fix or vendor advisory has been published to date.