Procedure examples

Versa Director Zero Day Exploitation resulted in the deployment of the VersaMem web shell for follow-on activity.

During Operation Wocao, threat actors used their own web shells, as well as those previously placed on target systems by other threat actors, for reconnaissance and lateral movement.

Leviathan relied extensively on web shell use following initial access for persistence and command execution purposes in victim environments during Leviathan Australian Intrusions.

During C0017, APT41 deployed JScript web shells through the creation of malicious ViewState objects.

During the 2022 Ukraine Electric Power Attack, Sandworm Team deployed the Neo-REGEORG webshell on an internet-facing server.

APT38 has used web shells for persistence or to ensure redundant access.

BlackByte has used ASPX web shells following exploitation of vulnerabilities in services such as Microsoft Exchange.

GALLIUM used Web shells to persist in victim environments and assist in execution and exfiltration.

Kimsuky has used modified versions of open source PHP web shells to maintain access, often adding "Dinosaur" references within the code.

Volt Typhoon has used webshells, including ones named AuditReport.jspx and iisstart.aspx, in compromised environments.

Dragonfly has commonly created Web shells on victims' publicly accessible email and web servers, which they used to maintain access to a victim network and download additional malicious files.

APT32 has used Web shells to maintain access to victim websites.

HAFNIUM has deployed multiple web shells on compromised servers including SIMPLESEESHARP, SPORTSBALL, China Chopper, and ASPXSpy.

Sandworm Team has used webshells including P.A.S. Webshell to maintain access to victim networks.

CURIUM has been linked to web shells following likely server compromise as an initial access vector into victim networks.

Mustang Panda has used China Chopper web shells to maintain access to victims’ environments.

APT39 has installed ANTAK and ASPXSPY web shells.

Moses Staff has dropped a web shell onto a compromised system.

OilRig has used web shells, often to maintain access to a victim network.

Tropic Trooper has started a web service in the target host and wait for the adversary to connect, acting as a web shell.

Sea Turtle deployed the SnappyTCP web shell during intrusion operations.

Leviathan relies on web shells for an initial foothold as well as persistence into the victim's systems.

APT29 has installed web shells on exploited Microsoft Exchange servers.

Medusa Group has utilized webshells to an exploited Microsoft Exchange Server.

BackdoorDiplomacy has used web shells to establish an initial foothold and for lateral movement within a victim's system.

Deep Panda uses Web shells on publicly accessible Web servers to access victim networks.

Ember Bear deploys web shells following initial access for either follow-on command execution or protocol tunneling. Example web shells used by Ember Bear include P0wnyshell, reGeorg, P.A.S. Webshell, and custom variants of publicly-available web shell examples.

Volatile Cedar can inject web shell code into a server.

Agrius typically deploys a variant of the ASPXSpy web shell following initial access via exploitation.

APT28 has used a modified and obfuscated version of the reGeorg web shell to maintain persistence on a target's Outlook Web Access (OWA) server.

APT5 has installed multiple web shells on compromised servers including on Pulse Secure VPN appliances.

Fox Kitten has installed web shells on compromised hosts to maintain access.

Tonto Team has used a first stage web shell after compromising a vulnerable Exchange server.

Magic Hound has used multiple web shells to gain execution.

Threat Group-3390 has used a variety of Web shells.

FIN13 has utilized obfuscated and open-source web shells such as JspSpy, reGeorg, MiniWebCmdShell, and Vonloesch Jsp File Browser 1.2 to enable remote code execution and to execute commands on compromised web server.

SEASHARPEE is a Web shell.

reGeorg is a web shell that has been installed on exposed web servers for access to victim environments.

BUSHWALK is a web shell that has the ability to execute arbitrary commands or write files.

P.A.S. Webshell can gain remote access and execution on target web servers.

GLASSTOKEN is a web shell capable of tunneling C2 connections and code execution on compromised Ivanti Secure Connect VPNs.

ASPXSpy is a Web shell. The ASPXTool version used by Threat Group-3390 has been deployed to accessible servers running Internet Information Services (IIS).

China Chopper's server component is a Web Shell payload.

SnappyTCP is a reverse TCP shell with command and control capabilities used for persistence purposes.

LIGHTWIRE is a web shell capable of command execution and establishing persistence on compromised Ivanti Secure Connect VPNs.

Line Runner is a persistent Lua-based web shell.

RAPIDPULSE is a web shell that is capable of arbitrary file read on targeted web servers to exfiltrate items of interest on the victim device.

PHPsert can use the .php assert function to execute attacker-provided code and maintain persistence on targeted web servers.

PULSECHECK is a web shell that can enable command execution on compromised servers.

OwaAuth is a Web shell that appears to be exclusively used by Threat Group-3390. It is installed as an ISAPI filter on Exchange servers and shares characteristics with the China Chopper Web shell.