Hackers Use ASP.NET Machine Keys to Break Into IIS, Push Malicious Extensions

According to Elastic Security Labs, in September 2025 Texas A&M University System (TAMUS) Cybersecurity, a managed detection and response provider, in collaboration with Elastic Security Labs, uncovered a sophisticated post‑exploitation campaign by a Chinese‑speaking threat actor.

The group installed a malicious IIS module named TOLLBOOTH, deployed a Godzilla‑forked webshell framework, used the GotoHTTP remote management tool, and introduced a kernel‑mode rootkit to conceal its presence; the operation is tracked under the REF3927 cluster and has affected hundreds of servers across multiple industries.

The initial compromise stemmed from deserialization attacks against the ASP.NET ViewState mechanism, exploiting ASP.NET machine keys—comprising the ValidationKey and DecryptionKey—used to protect ViewState and authentication cookies. Misconfigured IIS servers that reused these machine keys publicly were exploited, with resources such as Microsoft documentation and StackOverflow cited as published references.

A Base64‑encoded ViewState payload generated by ysoserial[.]net triggered code execution, producing an HTTP 500 error on vulnerable servers, while post‑exploitation activity included loading a modified Hidden rootkit and deploying the TOLLBOOTH module to harvest configuration and control traffic.

The investigation highlights 571 active TOLLBOOTH infections worldwide and urges organisations to rotate exposed machine keys, audit IIS configurations, enable ViewState validation, and deploy endpoint protection to detect kernel driver loads and unauthorised module installations.