The Initial Access Broker (IAB), known as Gold Melody, has been linked to a campaign exploiting leaked ASP.NET machine keys to gain unauthorized access to organizations. This activity is tracked by Palo Alto Networks Unit 42 as TGR-CRI-0045, with the group also known as Prophet Spider and UNC961. Gold Melody has targeted sectors in Europe and the U.S., including financial services, manufacturing, and logistics, using opportunistic approaches. Microsoft first documented the abuse of ASP.NET machine keys in February 2025, identifying over 3,000 keys that can be weaponized for ViewState code injection attacks, leading to arbitrary code execution. The attacks were initially detected in December 2024, when a static ASP.NET machine key was used to inject malicious code and deliver the Godzilla post-exploitation framework. Unit 42’s analysis indicates that TGR-CRI-0045 employs these leaked keys for ASP.NET ViewState deserialization, allowing malicious payloads to execute directly in server memory. This technique minimizes on-disk presence and forensic artifacts, bypassing many legacy EDR solutions. Organizations relying on file integrity monitoring or antivirus signatures may miss such intrusions, underscoring the need for behavioral detections based on anomalous IIS request patterns. A spike in activity was noted between late January and March 2025, with post-exploitation tools such as port scanners and bespoke C# programs deployed for local privilege escalation. The attacks typically involve command shell execution from IIS web servers, using tools like ysoserial.net for payload generation. These payloads bypass ViewState protections, executing .NET assemblies in memory. Gold Melody’s approach to the ViewState exploitation involves loading a single, stateless assembly, requiring repeated exploitation for each command execution. This campaign highlights cryptographic key exposure threats. CTIX analysts recommend identifying and remediating compromised Machine Keys to strengthen application security and identity protection strategies.