{
  "Event": {
    "analysis": "1",
    "date": "2026-06-05",
    "extends_uuid": "",
    "info": "[Threat Intel] Agentic AI Uncovers New China-Linked Cluster OP-512",
    "protected": false,
    "publish_timestamp": "1781329209",
    "published": true,
    "threat_level_id": "2",
    "timestamp": "1781329209",
    "uuid": "54c810b9-3973-49b3-9c8a-9c9220a1204f",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:producer=\"ReliaQuest\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#e7d48a",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Owner/User Discovery - T1033\"",
        "relationship_type": ""
      },
      {
        "colour": "#bb2745",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Standard Encoding - T1132.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Domain Generation Algorithms - T1568.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#d74cce",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Bypass User Account Control - T1548.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#110e53",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"DNS - T1071.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#56c932",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Symmetric Cryptography - T1573.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#a92e1c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"",
        "relationship_type": ""
      },
      {
        "colour": "#9feaf0",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exploit Public-Facing Application - T1190\"",
        "relationship_type": ""
      },
      {
        "colour": "#edf46c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Timestomp - T1070.006\"",
        "relationship_type": ""
      },
      {
        "colour": "#fe1ef0",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Shell - T1505.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#9e51c3",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Create Process with Token - T1134.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#62f4c1",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Process Discovery - T1057\"",
        "relationship_type": ""
      },
      {
        "colour": "#57997c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Bidirectional Communication - T1102.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#02475d",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Windows Command Shell - T1059.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#177374",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Non-Standard Encoding - T1132.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#92e858",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#4c0fbb",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Ingress Tool Transfer - T1105\"",
        "relationship_type": ""
      },
      {
        "colour": "#cb2c9b",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Dynamic-link Library Injection - T1055.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#c295b4",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Internal Proxy - T1090.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#120046",
        "local": false,
        "name": "rectifyq:sub-category=\"infra-profile\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#55acee",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"potentially-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#f1dfed",
        "local": false,
        "name": "rectifyq:TA-category=\"APT\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780916418",
        "to_ids": false,
        "type": "link",
        "uuid": "4a1fc0b3-f1a2-4ae9-81b3-4f8822fa876b",
        "value": "https://reliaquest.com/blog/threat-spotlight-reliaquests-agentic-ai-uncovers-new-china-linked-cluster-op-512"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780916418",
        "to_ids": false,
        "type": "text",
        "uuid": "8dad6738-d6f4-442b-b311-78f2e60a179a",
        "value": "A newly identified China-linked espionage cluster designated OP-512 has been discovered targeting Internet Information Services (IIS) servers through advanced AI-driven detection. The operation involves deploying a sophisticated custom web shell framework consisting of three components: a file manager with command-and-control notification channel and two cryptographically authenticated command handlers. Each deployment is cryptographically unique, utilizing RSA and RC4 encryption alongside timestomping techniques to evade signature-based detection. The attacker maintained persistence for 75 days before rapid deployment of multiple access paths, privilege escalation tools including BadPotato, SweetPotato, and EfsPotato, and establishment of dual notification channels through DNS and HTTP. The framework employs hex-encoded subdomain queries for self-reporting and automated builder-generated code with randomized variables. This represents the fourth China-linked cluster documented targeting legacy IIS infrast..."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780916418",
        "to_ids": false,
        "type": "text",
        "uuid": "5b3d5c2d-8f67-463c-b380-e9d95809b199",
        "value": "Name: Agentic AI Uncovers New China-Linked Cluster OP-512\nAuthor: AlienVault\nAdversary: OP-512\nTags: [\"gamshen\", \"plugx\", \"meterpreter\", \"cobalt strike\", \"ghostkit\", \"efspotato\", \"timestomping\"]\nTgtd countries: []\nMlwr families: [\"GhostKit\", \"BadPotato\", \"SweetPotato\", \"EfsPotato\", \"Meterpreter\", \"PlugX - S0013\", \"Thoper\", \"TVT\", \"DestroyRAT\", \"Sogu\", \"Kaba\", \"Korplug\", \"Cobalt Strike - S0154\", \"Rungan\", \"Gamshen\", \"BadIIS\"]\nAttack_ids: [\"T1033\", \"T1132.001\", \"T1568.002\", \"T1548.002\", \"T1071.004\", \"T1573.001\", \"T1140\", \"T1190\", \"T1070.006\", \"T1505.003\", \"T1134.002\", \"T1057\", \"T1102.002\", \"T1059.003\", \"T1132.002\", \"T1071.001\", \"T1105\", \"T1055.001\", \"T1090.001\"]\nIndustries: []"
      },
      {
        "category": "Attribution",
        "comment": "Adversary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781314715",
        "to_ids": false,
        "type": "threat-actor",
        "uuid": "76add0e3-76e6-44ac-b6eb-f531e123e789",
        "value": "OP-512",
        "Tag": [
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:producer=\"ReliaQuest\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"china\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Meterpreter C2 server on non-standard por",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781324100",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "86aba795-691d-45ea-ac7d-435d31ff5b3d",
        "value": "43.160.202.246",
        "Tag": [
          {
            "colour": "#dd7331",
            "local": false,
            "name": "asn:asn=\"132203\"",
            "relationship_type": ""
          },
          {
            "colour": "#723dcd",
            "local": false,
            "name": "asn:as-owner=\"TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue\"",
            "relationship_type": ""
          },
          {
            "colour": "#9256df",
            "local": false,
            "name": "asn:as-country=\"CN\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"china\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Source IP for web shell interaction. High-signal due to the combination of python-requests/2.33.0 user agent, POST requests to upload paths containing .aspx files, and timing aligned with the web shell deployment window.",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781324121",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "5fe2cf5f-5674-48ec-8c06-b9264dc93906",
        "value": "124.156.129.151",
        "Tag": [
          {
            "colour": "#dd7331",
            "local": false,
            "name": "asn:asn=\"132203\"",
            "relationship_type": ""
          },
          {
            "colour": "#723dcd",
            "local": false,
            "name": "asn:as-owner=\"TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue\"",
            "relationship_type": ""
          },
          {
            "colour": "#9256df",
            "local": false,
            "name": "asn:as-country=\"CN\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"china\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Outbound connection from compromised host",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781324142",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "c0634c34-2160-4ae4-b6d0-30f8785bb223",
        "value": "140.206.161.227",
        "Tag": [
          {
            "colour": "#6f60d3",
            "local": false,
            "name": "asn:asn=\"140979\"",
            "relationship_type": ""
          },
          {
            "colour": "#886fba",
            "local": false,
            "name": "asn:as-owner=\"UNICOM-SHFT-IDC China Unicom Shanghai FuTe IDC network\"",
            "relationship_type": ""
          },
          {
            "colour": "#9256df",
            "local": false,
            "name": "asn:as-country=\"CN\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"china\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Outbound connection from compromised host",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781324163",
        "to_ids": true,
        "type": "url",
        "uuid": "9f799e37-881f-4496-a263-a3d3cea4ed9d",
        "value": "http://140.206.161.227:443",
        "Tag": [
          {
            "colour": "#f08989",
            "local": false,
            "name": "NotFoundError",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Meterpreter C2 server on non-standard port",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781324184",
        "to_ids": true,
        "type": "url",
        "uuid": "9c6fb7dc-eadc-42c3-8aa2-d5cabceeb194",
        "value": "http://43.160.202.246:8053",
        "Tag": [
          {
            "colour": "#f08989",
            "local": false,
            "name": "NotFoundError",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "DNS C2 domain used by the self-reporting notification channel",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781324205",
        "to_ids": true,
        "type": "domain",
        "uuid": "262866b6-846d-48c6-a6fc-5dab7acb5b5c",
        "value": "hcgos.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "DNS C2 domain observed during earlier activity on the same host, approximately 75 days before the primary incident. The use of a different domain from the later intrusion (hcgos[.]com) suggests infrastructure rotation between visits.",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781324226",
        "to_ids": true,
        "type": "hostname",
        "uuid": "054e2744-6d10-462f-853e-9622f5c27656",
        "value": "ashx.lhlsjcb.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781324248",
        "to_ids": true,
        "type": "hostname",
        "uuid": "2aee49d7-c31f-4473-880f-b1fa05fc99c1",
        "value": "c.hcgos.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "On port 8053",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781314778",
        "to_ids": true,
        "type": "ip-dst|port",
        "uuid": "eb158be2-ce97-44b1-bcda-b4996fc7048a",
        "value": "43.160.202.246|8053"
      },
      {
        "category": "Network activity",
        "comment": "On port 443",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781314778",
        "to_ids": true,
        "type": "ip-dst|port",
        "uuid": "78e0291c-5641-4541-9cf2-151c8768825a",
        "value": "140.206.161.227|443"
      }
    ]
  }
}