Hackers Use ASP.NET Machine Keys to Break Into IIS, Push Malicious Extensions

In September 2025, Texas A&M University System (TAMUS) Cybersecurity, a managed detection and response provider, in collaboration with Elastic Security Labs, uncovered a sophisticated post-exploitation campaign by a Chinese-speaking threat actor. Using this method, the attackers installed a malicious IIS module named TOLLBOOTH, deployed a Godzilla-forked webshell framework, leveraged the GotoHTTP remote monitoring and management […]

The post Hackers Use ASP.NET Machine Keys to Break Into IIS, Push Malicious Extensions appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.