Exploitation of Leaked Machine Keys by Initial Access Broker

An initial access broker exploited leaked Machine Keys on ASP.NET sites to gain unauthorized access to organizations. The group, tracked as TGR-CRI-0045, targeted industries in Europe and the U.S.including finance, manufacturing, and technology. They used ASP.NET View State deserialization to execute malicious payloads in server memory, minimizing forensic artifacts. The attackers deployed post-exploitation tools for persistence and privilege escalation. The campaign began in October 2024, with increased activity from January to March 2025. Organizations are advised to review and remediate compromised Machine Keys following Microsoft's guidance. The threat group is possibly linked to Gold Melody based on overlapping indicators and tactics.

• Citrix NetScaler ADC and Gateway · CitrixBleed 2 (CVE-2025-5777) 7 Steps to Dragonforce RansomwareExploitedVulnerability2026-07-09
• Stray Cat, Open Doors: How k0t Wanders Through the Network EdgeCampaign2026-10-21
• Open Season on Kapibala: Attacker Steals Over 18,000 Government Records Through WordPress ExploitationCampaign2026-09-22
• How AI Agents Turned One Exposed Endpoint into a Server TakeoverCampaign2026-10-15
• FortiBleed Operations Continue Targeting Exposed Systems Leading to Reports of LockoutsCampaign2026-10-07