Agentic AI Uncovers New China-Linked Cluster OP-512

A newly identified China-linked espionage cluster designated OP-512 has been discovered targeting Internet Information Services (IIS) servers through advanced AI-driven detection. The operation involves deploying a sophisticated custom web shell framework consisting of three components: a file manager with command-and-control notification channel and two cryptographically authenticated command handlers. Each deployment is cryptographically unique, utilizing RSA and RC4 encryption alongside timestomping techniques to evade signature-based detection. The attacker maintained persistence for 75 days before rapid deployment of multiple access paths, privilege escalation tools including BadPotato, SweetPotato, and EfsPotato, and establishment of dual notification channels through DNS and HTTP. The framework employs hex-encoded subdomain queries for self-reporting and automated builder-generated code with randomized variables. This represents the fourth China-linked cluster documented targeting legacy IIS infrast...

• Melofee: a look back at a Linux implant and its new variantsMalware2026-09-10
• One Target, Two Flags | Rival Espionage Actors Converge On Pakistani Law EnforcementMalware2026-07-09
• The banana stand: brokering and managing infections across Asia using MQTTMalware2026-09-16
• CoolClient backdoor goes deeper: Windows kernel rootkit addedMalware2026-08-14
• Analysis of a Modular Cyber Espionage FrameworkMalware2026-08-07