UnclassifiedIdeologyAdvanced sophistication
OP-512
OP-512 is a China-attributed threat actor group with an ideological motive, tracked by Brandefense. It uses 5 MITRE ATT&CK techniques.
- Origin
- China
- Techniques
- 5
- Exploited CVEs
- No CVE data
- Record updated
About OP-512.
A newly identified China-linked threat cluster that targets legacy Microsoft IIS servers using a custom, polymorphic web shell framework and advanced evasion techniques like timestomping. The group focuses on espionage and utilizes purpose-built tools to bypass traditional security detections and maintain persistent access to high-value targets.
Last updated Jul 6, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.