Copied ASP.NET Keys Turned 571 IIS Servers Into an SEO Fraud Network: Jia Yu Chan and Salim Bitam at VB2026
Hundreds of IIS servers were compromised with ASP.NET machine keys that anyone could copy from StackOverflow or Microsoft's own documentation.
A reused machine key lets an attacker forge ViewState payloads. The server deserializes them and runs the attacker's code.
A Chinese-speaking actor tracked as REF3927 used that trick at scale. Elastic, working with Texas A&M University System Cybersecurity, found 571 actively infected servers across every industry vertical, none of them in China.
In their VB2026 talk, "Paying the TOLL: how REF3927 turned 571 IIS servers into an SEO fraud network", on Thursday, October 15 at 3:00 p.m., Jia Yu Chan and Salim Bitam walk through the full kill chain.
Speakers:
- Jia Yu Chan, Malware Research Engineer, Elastic Security Labs
- Salim Bitam, Senior Threat Researcher, Elastic Security Labs
After getting in, the actor deployed a Godzilla-derived webshell framework and the GotoHTTP remote management tool. A modified version of the open-source "Hidden" kernel rootkit concealed processes, files and registry entries.
The end goal is TOLLBOOTH, a malicious IIS module. It serves keyword-stuffed link-farm pages to search engine crawlers while redirecting human visitors to attacker landing pages.
TOLLBOOTH also carries its own webshell. The spread across sectors points to automated, opportunistic targeting, and the investigation is still ongoing.
The talk reverse engineers each tool in the chain. It closes with detection rules and remediation guidance.
For defenders, the first fix is simple. Never deploy a machine key that appears in public samples, and rotate any key that might have leaked.
Jia Yu Chan is a malware research engineer at Elastic Security Labs who hunts new threats, reverse engineers them and writes YARA rules. His research covers infostealers, malware-as-a-service, loader chains and signed driver abuse, including Elastic's BADIIS to the Bone report.
Salim Bitam is a senior threat researcher at Elastic Security Labs who automates binary analysis and builds configuration extractors. He previously worked on red and purple teams building custom offensive tooling.
Bitam presented his FINALDRAFT backdoor research at CODE BLUE 2025. His Elastic work also covers GHOSTPULSE, PIKABOT and the r77 rootkit (author page).
To go deeper on the topic, start here:
- Research: Elastic, "TOLLBOOTH: What's yours, IIS mine", the core report with YARA rules and the 571-server count.
- Research: HarfangLab, "RudePanda owns IIS servers like 2003", parallel research tracing the stolen keys to a 2003 MSDN example.
- Coverage: The Hacker News on Microsoft finding more than 3,000 publicly disclosed ASP.NET machine keys.
- Research: Elastic, "BADIIS to the Bone", on a related IIS SEO-poisoning cluster that hit more than 1,800 servers.
- Indicators: Elastic's TOLLBOOTH indicators on GitHub.
Anyone running IIS or asp.net applications should check their machine keys after hearing this one.
Have you ever audited where your ASP.NET machine keys came from?
2 points · 1 comment
Mentions
Copied ASP.NET Keys Turned 571 IIS Servers Into an SEO Fraud Network: Jia Yu Chan and Salim Bitam at VB2026 Hundreds of IIS servers were compromised with ASP.NET machine keys that anyone could copy from StackOverflow or Microsoft's own documentation. A reused machine key lets an attacker forge ViewState payloads. The server deserializes them and runs the attacker's code. A Chinese-speaking actor tracked as REF3927 used that trick at scale. Elastic, working with Texas A&M University System Cybersecurity, found 571 actively infected servers across every industry vertical, none of them in China. In their VB2026 talk, "Paying the TOLL: how REF3927 turned 571 IIS servers into an SEO fraud network", on Thursday, October 15 at 3:00 p.m., Jia Yu Chan and Salim Bitam walk through the full kill chain. Speakers: - Jia Yu Chan, Malware Research Engineer, Elastic Security Labs - Salim Bitam, Senior Threat Researcher, Elastic Security Labs After getting in, the actor deployed a Godzilla-derived webshell framework and the GotoHTTP remote management tool. A modified version of the open-source "Hidden" kernel rootkit concealed processes, files and registry entries. The end goal is TOLLBOOTH, a malicious IIS module. It serves keyword-stuffed link-farm pages to search engine crawlers while redirecting human visitors to attacker landing pages. TOLLBOOTH also carries its own webshell. The spread across sectors points to automated, opportunistic targeting, and the investigation is still ongoing. The talk reverse engineers each tool in the chain. It closes with detection rules and remediation guidance. For defenders, the first fix is simple. Never deploy a machine key that appears in public samples, and rotate any key that might have leaked. Jia Yu Chan is a malware research engineer at Elastic Security Labs who hunts new threats, reverse engineers them and writes YARA rules. His research covers infostealers, malware-as-a-service, loader chains and signed driver abuse, including Elastic's BADIIS to the Bone report. Salim Bitam is a senior threat researcher at Elastic Security Labs who automates binary analysis and builds configuration extractors. He previously worked on red and purple teams building custom offensive tooling. Bitam presented his FINALDRAFT backdoor research at CODE BLUE 2025. His Elastic work also covers GHOSTPULSE, PIKABOT and the r77 rootkit (author page). To go deeper on the topic, start here: - Research: Elastic, "TOLLBOOTH: What's yours, IIS mine", the core report with YARA rules and the 571-server count. - Research: HarfangLab, "RudePanda owns IIS servers like 2003", parallel research tracing the stolen keys to a 2003 MSDN example. - Coverage: The Hacker News on Microsoft finding more than 3,000 publicly disclosed ASP.NET machine keys. - Research: Elastic, "BADIIS to the Bone", on a related IIS SEO-poisoning cluster that hit more than 1,800 servers. - Indicators: Elastic's TOLLBOOTH indicators on GitHub. Anyone running IIS or asp.net applications should check their machine keys after hearing this one. Have you ever audited where your ASP.NET machine keys came from?
@kyREcon @_josehelps @HuntressLabs @M_haggis I believe it had a valid license key; ElasticSearch's previous tooling had to be modified to facilitate handling of the newer format and was the basis for how we got at the beacon. github.com/elastic/labs-releases/tree/main/tools/… Will follow up on Monday!