As cited
Copy frozen at (site build).
threat intel
TOLLBOOTH: What's yours, IIS mine
REF3927 exploits publicly disclosed ASP.NET machine keys to compromise Internet Information Services (IIS) servers and deploy TOLLBOOTH search engine optimization (SEO) cloaking modules worldwide. The threat actor leverages known key material to gain unauthorized access and inject malicious SEO redirects at scale.
Why it matters: IIS administrators running ASP.NET applications are exposed if they have not rotated machine keys or patched systems; TOLLBOOTH deployment compromises search visibility and site integrity, requiring immediate key rotation and server inspection.
- Source published
- First seen by Cybersecurity Tracker