# China-Linked Cyber Espionage: How OP-512 Exploited Legacy IIS Servers and Evaded Detection

Page: https://stenobird.com/podcast/shadowtalk-powered-by-reliaquest-61547/china-linked-cyber-espionage-how-op-512-exploited-legacy-iis-servers-and-evaded-detection
Text version: https://stenobird.com/podcast/shadowtalk-powered-by-reliaquest-61547/china-linked-cyber-espionage-how-op-512-exploited-legacy-iis-servers-and-evaded-detection.md
Podcast: [ShadowTalk: Powered by ReliaQuest](https://stenobird.com/podcast/shadowtalk-powered-by-reliaquest-61547)
Published: 2026-06-10T13:00:00+00:00
Episode link: https://www.buzzsprout.com/2154459/episodes/19325542-china-linked-cyber-espionage-how-op-512-exploited-legacy-iis-servers-and-evaded-detection.mp3
Audio file: https://www.buzzsprout.com/2154459/episodes/19325542-china-linked-cyber-espionage-how-op-512-exploited-legacy-iis-servers-and-evaded-detection.mp3
Processing state: not_requested
JSON: https://stenobird.com/v1/public/podcasts/shadowtalk-powered-by-reliaquest-61547/episodes/china-linked-cyber-espionage-how-op-512-exploited-legacy-iis-servers-and-evaded-detection
Duration seconds: 1388

## Resource

Your team built defenses around known China-linked clusters. The file hashes are tracked. The behavioral patterns are documented. What those weren't built to catch is a new cluster that studied those exact defenses and engineered around them. A China-linked attacker compromised an internet-facing IIS server, maintained access for over 75 days, and came back on fresh infrastructure. With four China-linked clusters converging on the same legacy IIS stack in twelve months, defenders building det...

## Actions

- request_transcript: `POST https://stenobird.com/v1/public/podcasts/shadowtalk-powered-by-reliaquest-61547/episodes/china-linked-cyber-espionage-how-op-512-exploited-legacy-iis-servers-and-evaded-detection/transcription-requests` — Idempotently request low-priority transcript generation for this episode.
- read_markdown: `GET https://stenobird.com/podcast/shadowtalk-powered-by-reliaquest-61547/china-linked-cyber-espionage-how-op-512-exploited-legacy-iis-servers-and-evaded-detection.md` — Read the agent-friendly Markdown representation of this episode resource.

A page view does not enqueue transcription. Agents should invoke `request_transcript` explicitly when they need this episode processed.

## Transcript

Full transcripts are not published on public pages unless there is a clear rights basis.