SecuriTricks - asp.net

Four Malicious NuGet Packages Target ASP.NET Developers With JIT Hooking and Credential Exfiltration

A NuGet supply chain attack involving four malicious packages targeting ASP.NET web application developers has been discovered. The campaign deploys a multi-stage payload where NCryptYo acts as a dropper, establishing a local proxy, while companion packages exfiltrate ASP.NET Identity data and acce…

backdoor

obfuscation

credential-exfiltration

Published: February 24, 2026

Downloadable IOCs: 4

Exploitation of Leaked Machine Keys by Initial Access Broker

An initial access broker exploited leaked Machine Keys on ASP.NET sites to gain unauthorized access to organizations. The group, tracked as TGR-CRI-0045, targeted industries in Europe and the U.S. including finance, manufacturing, and technology. They used ASP.NET View State deserialization to exec…

initial access broker

view state deserialization

Published: July 9, 2025

Downloadable IOCs: 21

Code injection attacks using publicly disclosed ASP.NET machine keys

An unattributed threat actor has been observed exploiting publicly disclosed ASP.NET machine keys to perform ViewState code injection attacks, delivering the Godzilla post-exploitation framework. Over 3,000 publicly disclosed keys have been identified as potentially vulnerable to this attack method…

Published: February 6, 2025

Downloadable IOCs: 0

Tag: asp.net

Attack reports

Four Malicious NuGet Packages Target ASP.NET Developers With JIT Hooking and Credential Exfiltration

Exploitation of Leaked Machine Keys by Initial Access Broker

Code injection attacks using publicly disclosed ASP.NET machine keys