Technique:  Server Software Component:Web Shell
It has used a modified and obfuscated version of the reGeorg web shell to maintain persistence on a target's Outlook Web Access (OWA) server.
It has installed web shells on exploited Microsoft Exchange servers.
It has used Web shells to maintain access to victim websites.
It has used web shells for persistence or to ensure redundant access.
It has installed ANTAK and ASPXSPY web shells.
ASPXSpy is a Web shell. The ASPXTool version used by It has been deployed to accessible servers running Internet Information Services (IIS).
It has used web shells to establish an initial foothold and for lateral movement within a victim's system.
During C0017, It deployed JScript web shells through the creation of malicious ViewState objects.
China Chopper's server component is a Web Shell payload.
It uses Web shells on publicly accessible Web servers to access victim networks.
It has commonly created Web shells on victims' publicly accessible email and web servers, which they used to maintain access to a victim network and download additional malicious files.
It has utilized obfuscated and open-source web shells such as JspSpy, reGeorg, MiniWebCmdShell, and Vonloesch Jsp File Browser 1.2 to enable remote code execution and to execute commands on compromised web server.
It has installed web shells on compromised hosts to maintain access.
It used Web shells to persist in victim environments and assist in execution and exfiltration.
It has deployed multiple web shells on compromised servers including SIMPLESEESHARP, SPORTSBALL, China Chopper, and ASPXSpy.
It has used modified versions of open source PHP web shells to maintain access, often adding "Dinosaur" references within the code.
It relies on web shells for an initial foothold as well as persistence into the victim's systems.
It has used multiple web shells to gain execution.
It has dropped a web shell onto a compromised system.
It has used web shells, often to maintain access to a victim network.
During Operation CuckooBees, the threat actors generated a web shell within a vulnerable Enterprise Resource Planning Web Application Server as a persistence mechanism.
During Operation Wocao, threat actors used their own web shells, as well as those previously placed on target systems by other threat actors, for reconnaissance and lateral movement.
OwaAuth is a Web shell that appears to be exclusively used by It. It is installed as an ISAPI filter on Exchange servers and shares characteristics with the China Chopper Web shell.
P.A.S. Webshell can gain remote access and execution on target web servers.
It has used webshells including P.A.S. Webshell to maintain access to victim networks.
SEASHARPEE is a Web shell.
SUPERNOVA is a Web shell.
It has planted Web shells on Outlook Exchange servers.
It has used a variety of Web shells.
It has used a first stage web shell after compromising a vulnerable Exchange server.
It has started a web service in the target host and wait for the adversary to connect, acting as a web shell.
It can inject web shell code into a server.
It has used webshells, including ones named AuditReport.jspx and iisstart.aspx, in compromised environments.