← Back to feed
research Elastic Security Labs

TOLLBOOTH: What's yours, IIS mine

Elastic Security Labs

REF3927 abuses publicly disclosed ASP.NET machine keys to compromise IIS servers and deploy TOLLBOOTH SEO cloaking modules globally.

1 IOC
Read the full story Elastic Security Labs →

Related Coverage

research Agent Running in the Age of AI Recorded Future · Sep 22 research 21st September – Threat Intelligence Report Check Point Research · Sep 21 research SAML: A fractal of bad design Trail of Bits · Sep 21