China Chopper

China Chopper is a Web Shell hosted on Web servers to provide access back into an enterprise network that does not rely on an infected system calling back to a remote command and control server.[1] It has been used by several threat groups.[2][3][4][5]

ID: S0020
Platforms: Windows
Version: 2.5
Created: 31 May 2017
Last Modified: 03 January 2024

Techniques Used

Domain ID Name Use
Enterprise T1071 .001 Application Layer Protocol: Web Protocols

China Chopper's server component executes code sent via HTTP POST commands.[3]

Enterprise T1110 .001 Brute Force: Password Guessing

China Chopper's server component can perform brute force password guessing against authentication portals.[3]

Enterprise T1059 .003 Command and Scripting Interpreter: Windows Command Shell

China Chopper's server component is capable of opening a command terminal.[6][1][7]

Enterprise T1005 Data from Local System

China Chopper's server component can upload local files.[3][1][7][5]

Enterprise T1083 File and Directory Discovery

China Chopper's server component can list directory contents.[3][5]

Enterprise T1070 .006 Indicator Removal: Timestomp

China Chopper's server component can change the timestamp of files.[3][1][7]

Enterprise T1105 Ingress Tool Transfer

China Chopper's server component can download remote files.[3][1][7][5][8]

Enterprise T1046 Network Service Discovery

China Chopper's server component can spider authentication portals.[3]

Enterprise T1027 .002 Obfuscated Files or Information: Software Packing

China Chopper's client component is packed with UPX.[1]

Enterprise T1505 .003 Server Software Component: Web Shell

China Chopper's server component is a Web Shell payload.[1]

Groups That Use This Software


  1. Lee, T., Hanzlik, D., Ahl, I. (2013, August 7). Breaking Down the China Chopper Web Shell - Part I. Retrieved March 27, 2015.
  2. Dell SecureWorks Counter Threat Unit Threat Intelligence. (2015, August 5). Threat Group-3390 Targets Organizations for Cyberespionage. Retrieved August 18, 2018.
  3. FireEye. (2018, March 16). Suspected Chinese Cyber Espionage Group (TEMP.Periscope) Targeting U.S. Engineering and Maritime Industries. Retrieved April 11, 2018.
  4. CISA. (2021, July 19). (AA21-200A) Joint Cybersecurity Advisory – Tactics, Techniques, and Procedures of Indicted APT40 Actors Associated with China’s MSS Hainan State Security Department. Retrieved August 12, 2021.
  5. Eoin Miller. (2021, March 23). Defending Against the Zero Day: Analyzing Attacker Behavior Post-Exploitation of Microsoft Exchange. Retrieved October 27, 2022.
  6. Counter Threat Unit Research Team. (2017, June 27). BRONZE UNION Cyberespionage Persists Despite Disclosures. Retrieved July 13, 2017.
  7. The Australian Cyber Security Centre (ACSC), the Canadian Centre for Cyber Security (CCCS), the New Zealand National Cyber Security Centre (NZ NCSC), CERT New Zealand, the UK National Cyber Security Centre (UK NCSC) and the US National Cybersecurity and Communications Integration Center (NCCIC). (2018, October 11). Joint report on publicly available hacking tools. Retrieved March 11, 2019.
  8. Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.
  9. Cybereason Nocturnus. (2019, June 25). Operation Soft Cell: A Worldwide Campaign Against Telecommunications Providers. Retrieved July 18, 2019.