Chinese Hackers Exploit Exposed ASP.NET Keys to Deploy TOLLBOOTH IIS Backdoor and Kernel Rootkit

Researchers from Elastic Security Labs, in collaboration with Texas A&M University System (TAMUS) Cybersecurity, have uncovered a Chinese-speaking threat actor running a widespread campaign against misconfigured Microsoft IIS servers. The attackers deployed a malicious IIS module named “TOLLBOOTH” along with a modified Hidden-based kernel rootkit (rebranded as HIDDENDRIVER) and a Godzilla-forged webshell framework to maintain persistence and evade detection.

By exploiting publicly exposed ASP.NET machine keys, they could forge serialized payloads and execute commands via ViewState deserialization, enabling a backdoor with SEO cloaking and webshell capabilities. The activity cluster, identified as REF3927, infected 571 IIS servers worldwide across finance, logistics, government and academia, with no victims located in mainland China.

The campaign also used a Z-Godzilla_ekp variant with an AMSI bypass plugin and encrypted communications, and a userland app, HIDDENCLI, to manage hidden components.