Cybersecurity researchers have discovered a previously unreported threat cluster dubbed OP-512 (where "OP" stands for "opponent") that has been observed targeting Microsoft Internet Information Services (IIS) servers to deploy a bespoke web shell framework.

ReliaQuest has assessed with moderate to high confidence that the espionage-focused activity is linked to China.

"OP-512 was highly