Hackers Exploit Exposed IIS ASP.NET Keys to Inject Malicious Modules

Summary Points

1. A sophisticated cyberattack exploits outdated ASP.NET machine keys, affecting around 240 IPs and 280 domains globally, allowing remote code execution on IIS servers.
2. Attackers deploy malicious modules (ScriptsModule, CachesModule) and a custom rootkit (Wingtb.sys) to hide their presence and evade detection, including systematic log deletion.
3. The campaign employs advanced persistence techniques like privilege escalation (EfsPotato, DeadPotato) and installs backdoors enabling remote command execution via a specific URL path.
4. Primarily targeting SEO fraud for cryptocurrency schemes, the attack also poses serious security threats with the potential for further espionage and system compromise.

The Issue

In late August and early September 2025, a highly sophisticated cyberattack campaign was uncovered targeting Microsoft IIS servers worldwide. The hackers exploited long-standing security flaws in ASP.NET, specifically the public exposure of machine keys dating back to 2003, which allowed them to manipulate server viewstate data and execute arbitrary commands without needing credentials. Once inside, they employed advanced privilege escalation tools like EfsPotato and DeadPotato to gain administrative access, then deployed malicious DLL modules—ScriptsModule and IsapiCachesModule—that intercepted web traffic at the earliest stages. To hide their presence, they installed a custom kernel rootkit called Wingtb.sys, signed with an expired certificate, and executed a disruptive script that deleted Windows Event logs, hinting at some operational inconsistency or inexperience. These modules not only enabled the attackers to conduct SEO fraud—embedding malicious links into search results for cryptocurrency scams—but also created a dangerous remote command execution backdoor accessible via the /scjg URL, raising concerns about broader espionage and security breaches. The threat was identified by HarfangLab analysts during routine system monitoring, who uncovered this intricate malware infrastructure designed both for fraudulent activities and potentially more malicious, covert operations.

Potential Risks

The threat of hackers hijacking IIS servers by exploiting exposed ASP .NET machine keys to inject malicious modules is a serious risk that could infiltrate any business’s digital infrastructure, regardless of size or industry. If an attacker gains access through these exposed keys, they can commandeer your web server, manipulate or insert harmful code, and potentially compromise sensitive customer data, financial information, or proprietary systems. This type of breach doesn’t just threaten your data integrity; it can lead to costly downtime, damage your reputation, invite legal consequences, and erode customer trust, making your business vulnerable to profit loss and long-term operational disruption.

Possible Action Plan

In the rapidly evolving landscape of cybersecurity threats, swift and effective remediation of vulnerabilities is crucial to prevent devastating breaches, especially when attackers exploit exposed IIS servers through compromised ASP.NET machine keys to inject malicious modules. Addressing such issues promptly not only restores system integrity but also minimizes potential damage and data loss.

Assessment & Identification

• Conduct thorough vulnerability scans on IIS servers
• Review server logs for signs of exploitation or unauthorized activity
• Validate the integrity of ASP.NET machine keys

Immediate Containment

• Isolate affected servers from network to prevent further malicious activity
• Disable compromised modules and services promptly

Secure Configuration

• Reconfigure IIS settings to restrict access and enhance security controls
• Regenerate and secure ASP.NET machine keys using strong, unpredictable values

Patch & Update

• Apply the latest security patches for IIS, ASP.NET, and related software
• Update all relevant firmware and software components to the latest versions

Enhanced Monitoring

• Implement continuous monitoring for unusual activity or new vulnerabilities
• Set up alerting on suspicious behaviors related to IIS and associated modules

Verification & Testing

• Verify the effectiveness of remediation measures through tests and scans
• Conduct penetration testing to ensure vulnerabilities are fully addressed

Documentation & Communication

• Document the incident, remediation efforts, and lessons learned
• Communicate findings and strategies to relevant stakeholders and security teams

Stay Ahead in Cybersecurity

Discover cutting-edge developments in Emerging Tech and industry Insights.

Learn more about global cybersecurity standards through the NIST Cybersecurity Framework.

Disclaimer: The information provided may not always be accurate or up to date. Please do your own research, as the cybersecurity landscape evolves rapidly. Intended for secondary references purposes only.

Cyberattacks-V1cyberattack-v1-multisource