TOLLBOOTH: What's yours, IIS mine — Elastic Security Labs

A Chinese-speaking threat actor, REF3927, is exploiting publicly disclosed ASP.NET machine keys to globally compromise IIS servers, deploying the TOLLBOOTH malware for SEO cloaking, persistent access, and monetization through a sophisticated blend of webshells, rootkits, and remote management tools.