Tag: updf

1 Attack Reports | 0 Vulnerabilities

Attack reports

Exploitation of Leaked Machine Keys by Initial Access Broker

An initial access broker exploited leaked Machine Keys on ASP.NET sites to gain unauthorized access to organizations. The group, tracked as TGR-CRI-0045, targeted industries in Europe and the U.S. including finance, manufacturing, and technology. They used ASP.NET View State deserialization to exec…
in-memory execution
privilege escalation
post-exploitation
iis
initial access broker
asp.net
machine keys
2025-07-09
txportmap
updf
view state deserialization
Published: July 9, 2025
Downloadable IOCs: 21
Click here to see more Attack Reports