OP-512 and the Web Shell That Never Looks the Same Twice

A China-linked espionage cluster is using cryptographically unique web shells against IIS servers, making traditional detection far more difficult. The Problem With Looking for Known Malware Security