IIS Servers Hijacked via Exposed ASP.NET Machine Keys — Malicious Modules Injected in the Wild

Security researchers have uncovered a cyberattack campaign that exploited publicly exposed ASP.NET machine keys to compromise hundreds of Internet Information Services (IIS) servers worldwide. The operation, detected in late August and early September 2025, deployed a previously undocumented malicious module dubbed “HijackServer” that transforms legitimate web servers into tools for search engine manipulation while maintaining persistent backdoor access.

The attackers used a cryptographic secret published in a 2003 Microsoft Developer Network article to enable viewstate deserialization and remote code execution on vulnerable servers. Researchers identified 171 distinct HijackServer installations affecting approximately 240 server IP addresses and 280 domain names, with the campaign primarily targeting servers in Asia and the oldest compromise dating back to 2024 on a server geolocated in Singapore.

The toolkit also included a rootkit derived from the open-source “Hidden” project and a kernel driver signed with an expired certificate, and the backdoor allows unauthenticated remote command execution through specific URL paths, according to Elastic Security Labs.