Server Software Component: Web Shell

During the 2022 Ukraine Electric Power Attack, Sandworm Team deployed the Neo-REGEORG webshell on an internet-facing server.^[3]

APT28 has used a modified and obfuscated version of the reGeorg web shell to maintain persistence on a target's Outlook Web Access (OWA) server.^[4]

APT29 has installed web shells on exploited Microsoft Exchange servers.^[5][6]

APT32 has used Web shells to maintain access to victim websites.^[7]

APT38 has used web shells for persistence or to ensure redundant access.^[8]

APT39 has installed ANTAK and ASPXSPY web shells.^[9]

APT5 has installed multiple web shells on compromised servers including on Pulse Secure VPN appliances.^[10][11]

ASPXSpy is a Web shell. The ASPXTool version used by Threat Group-3390 has been deployed to accessible servers running Internet Information Services (IIS).^[12]

BackdoorDiplomacy has used web shells to establish an initial foothold and for lateral movement within a victim's system.^[13]

BUSHWALK is a web shell that has the ability to execute arbitrary commands or write files.^[14]

During C0017, APT41 deployed JScript web shells through the creation of malicious ViewState objects.^[15]

During the C0032 campaign, TEMP.Veles planted Web shells on Outlook Exchange servers.^[16]

China Chopper's server component is a Web Shell payload.^[2]

During Cutting Edge, threat actors used multiple web shells to maintain presence on compromised Connect Secure appliances such as WIREFIRE, GLASSTOKEN, BUSHWALK, LIGHTWIRE, and FRAMESTING.^[17][18]

Deep Panda uses Web shells on publicly accessible Web servers to access victim networks.^[19]

Dragonfly has commonly created Web shells on victims' publicly accessible email and web servers, which they used to maintain access to a victim network and download additional malicious files.^[20]

FIN13 has utilized obfuscated and open-source web shells such as JspSpy, reGeorg, MiniWebCmdShell, and Vonloesch Jsp File Browser 1.2 to enable remote code execution and to execute commands on compromised web server.^[21]

Fox Kitten has installed web shells on compromised hosts to maintain access.^[22][23]

FRAMESTING is a web shell capable of enabling arbitrary command execution on compromised Ivanti Connect Secure VPNs.^[14]

GALLIUM used Web shells to persist in victim environments and assist in execution and exfiltration.^[24][25]

GLASSTOKEN is a web shell capable of tunneling C2 connections and code execution on compromised Ivanti Secure Connect VPNs.^[18]

HAFNIUM has deployed multiple web shells on compromised servers including SIMPLESEESHARP, SPORTSBALL, China Chopper, and ASPXSpy.^{[26][27][28][29][30]}

Kimsuky has used modified versions of open source PHP web shells to maintain access, often adding "Dinosaur" references within the code.^[31]

Leviathan relies on web shells for an initial foothold as well as persistence into the victim's systems.^[32][33]

LIGHTWIRE is a web shell capable of command execution and establishing persistence on compromised Ivanti Secure Connect VPNs.^[14]

Magic Hound has used multiple web shells to gain execution.^[34][35]

Moses Staff has dropped a web shell onto a compromised system.^[36]

OilRig has used web shells, often to maintain access to a victim network.^[37][38][39]

During Operation CuckooBees, the threat actors generated a web shell within a vulnerable Enterprise Resource Planning Web Application Server as a persistence mechanism.^[40]

During Operation Wocao, threat actors used their own web shells, as well as those previously placed on target systems by other threat actors, for reconnaissance and lateral movement.^[41]

OwaAuth is a Web shell that appears to be exclusively used by Threat Group-3390. It is installed as an ISAPI filter on Exchange servers and shares characteristics with the China Chopper Web shell.^[12]

P.A.S. Webshell can gain remote access and execution on target web servers.^[42]

PULSECHECK is a web shell that can enable command execution on compromised servers.^[10]

RAPIDPULSE is a web shell that is capable of arbitrary file read on targeted web servers to exfiltrate items of interest on the victim device.^[11]

Sandworm Team has used webshells including P.A.S. Webshell to maintain access to victim networks.^[42]

SEASHARPEE is a Web shell.^[38]

SLIGHTPULSE is a web shell that can read, write, and execute files on compromised servers.^[10]

STEADYPULSE is a web shell that can enable the execution of arbitrary commands on compromised web servers.^[10]

SUPERNOVA is a Web shell.^[43][44][45]

Threat Group-3390 has used a variety of Web shells.^[46]

Tonto Team has used a first stage web shell after compromising a vulnerable Exchange server.^[47]

Tropic Trooper has started a web service in the target host and wait for the adversary to connect, acting as a web shell.^[48]

Volatile Cedar can inject web shell code into a server.^[49][50]

Volt Typhoon has used webshells, including ones named AuditReport.jspx and iisstart.aspx, in compromised environments.^[51]

WIREFIRE is a web shell that can download files to and execute arbitrary commands from compromised Ivanti Connect Secure VPNs.^[17]

Consider disabling functions from web technologies such as PHP’s evaI() that may be abused for web shells.^[52]

Enforce the principle of least privilege by limiting privileges of user accounts so only authorized accounts can modify the web directory.^[53]