During the2022 Ukraine Electric Power Attack,Sandworm Team deployed the Neo-REGEORG webshell on an internet-facing server.^[3]

Agrius typically deploys a variant of theASPXSpy web shell following initial access via exploitation.^[4]

APT28 has used a modified and obfuscated version of the reGeorg web shell to maintain persistence on a target's Outlook Web Access (OWA) server.^[5]

APT29 has installed web shells on exploited Microsoft Exchange servers.^[6][7]

APT32 has used Web shells to maintain access to victim websites.^[8]

APT38 has used web shells for persistence or to ensure redundant access.^[9]

APT39 has installed ANTAK and ASPXSPY web shells.^[10]

APT41 DUST involved use of web shells such as ANTSWORD and BLUEBEAM for persistence.^[11]

APT5 has installed multiple web shells on compromised servers including on Pulse Secure VPN appliances.^[12][13]

ASPXSpy is a Web shell. The ASPXTool version used byThreat Group-3390 has been deployed to accessible servers running Internet Information Services (IIS).^[14]

BackdoorDiplomacy has used web shells to establish an initial foothold and for lateral movement within a victim's system.^[15]

BlackByte has used ASPX web shells following exploitation of vulnerabilities in services such as Microsoft Exchange.^[16][17]

BUSHWALK is a web shell that has the ability to execute arbitrary commands or write files.^[18]

DuringC0017,APT41 deployed JScript web shells through the creation of malicious ViewState objects.^[19]

During theC0032 campaign,TEMP.Veles planted Web shells on Outlook Exchange servers.^[20]

China Chopper's server component is a Web Shell payload.^[2]

CURIUM has been linked to web shells following likely server compromise as an initial access vector into victim networks.^[21]

DuringCutting Edge, threat actors used multiple web shells to maintain presence on compromised Connect Secure appliances such asWIREFIRE,GLASSTOKEN,BUSHWALK,LIGHTWIRE, andFRAMESTING.^[22][23]

Deep Panda uses Web shells on publicly accessible Web servers to access victim networks.^[24]

Dragonfly has commonly created Web shells on victims' publicly accessible email and web servers, which they used to maintain access to a victim network and download additional malicious files.^[25]

Ember Bear deploys web shells following initial access for either follow-on command execution or protocol tunneling. Example web shells used byEmber Bear include P0wnyshell, reGeorg,P.A.S. Webshell, and custom variants of publicly-available web shell examples.^[26][27]

FIN13 has utilized obfuscated and open-source web shells such as JspSpy, reGeorg, MiniWebCmdShell, and Vonloesch Jsp File Browser 1.2 to enable remote code execution and to execute commands on compromised web server.^[28]

Fox Kitten has installed web shells on compromised hosts to maintain access.^[29][30]

FRAMESTING is a web shell capable of enabling arbitrary command execution on compromised Ivanti Connect Secure VPNs.^[18]

FrostyGoop Incident deployed a ReGeorg variant web shell to impacted systems following initial access for persistence.^[31]

GALLIUM used Web shells to persist in victim environments and assist in execution and exfiltration.^[32][33]

GLASSTOKEN is a web shell capable of tunneling C2 connections and code execution on compromised Ivanti Secure Connect VPNs.^[23]

HAFNIUM has deployed multiple web shells on compromised servers including SIMPLESEESHARP, SPORTSBALL,China Chopper, andASPXSpy.^{[34][35][36][37][38][39]}

ForHomeLand Justice, threat actors used .aspx webshells named pickers.aspx, error4.aspx, and ClientBin.aspx, to maintain persistence.^[40][41]

Kimsuky has used modified versions of open source PHP web shells to maintain access, often adding "Dinosaur" references within the code.^[42]

Leviathan relies on web shells for an initial foothold as well as persistence into the victim's systems.^[43][44][45]

Leviathan relied extensively on web shell use following initial access for persistence and command execution purposes in victim environments duringLeviathan Australian Intrusions.^[45]

LIGHTWIRE is a web shell capable of command execution and establishing persistence on compromised Ivanti Secure Connect VPNs.^[18]

Line Runner is a persistent Lua-based web shell.^[46]

Magic Hound has used multiple web shells to gain execution.^[47][48]

Medusa Group has utilized webshells to an exploited Microsoft Exchange Server.^[49]

Moses Staff has dropped a web shell onto a compromised system.^[50]

Mustang Panda has usedChina Chopper web shells to maintain access to victims’ environments.^[51]

Neo-reGeorg can be installed on compromised web servers to tunnel C2 connections.^[52][3]

OilRig has used web shells, often to maintain access to a victim network.^{[53][54][55][56]}

DuringOperation CuckooBees, the threat actors generated a web shell within a vulnerable Enterprise Resource Planning Web Application Server as a persistence mechanism.^[57]

DuringOperation Wocao, threat actors used their own web shells, as well as those previously placed on target systems by other threat actors, for reconnaissance and lateral movement.^[58]

OwaAuth is a Web shell that appears to be exclusively used byThreat Group-3390. It is installed as an ISAPI filter on Exchange servers and shares characteristics with theChina Chopper Web shell.^[14]

P.A.S. Webshell can gain remote access and execution on target web servers.^[59]

PULSECHECK is a web shell that can enable command execution on compromised servers.^[12]

RAPIDPULSE is a web shell that is capable of arbitrary file read on targeted web servers to exfiltrate items of interest on the victim device.^[13]

reGeorg is a web shell that has been installed on exposed web servers for access to victim environments.^[7][26]

Sandworm Team has used webshells includingP.A.S. Webshell to maintain access to victim networks.^[59]

Sea Turtle deployed theSnappyTCP web shell during intrusion operations.^[60][61]

SEASHARPEE is a Web shell.^[54]

DuringSharePoint ToolShell Exploitation, threat actors followed exploitation of SharePoint servers with installation of a malicious .aspx web shell (spinstall0.aspx) that was written to the_layouts/15/ directory, granting persistent HTTP-based access.^{[62][63][64][65][66][67]}

SLIGHTPULSE is a web shell that can read, write, and execute files on compromised servers.^[12]

SnappyTCP is a reverse TCP shell with command and control capabilities used for persistence purposes.^[60]

STEADYPULSE is a web shell that can enable the execution of arbitrary commands on compromised web servers.^[12]

SUPERNOVA is a Web shell.^[68][69][70]

Threat Group-3390 has used a variety of Web shells.^[71]

Tonto Team has used a first stage web shell after compromising a vulnerable Exchange server.^[72]

Tropic Trooper has started a web service in the target host and wait for the adversary to connect, acting as a web shell.^[73]

Versa Director Zero Day Exploitation resulted in the deployment of the VersaMem web shell for follow-on activity.^[74]

Volatile Cedar can inject web shell code into a server.^[75][76]

Volt Typhoon has used webshells, including ones named AuditReport.jspx and iisstart.aspx, in compromised environments.^[77]

WIREFIRE is a web shell that can download files to and execute arbitrary commands from compromised Ivanti Connect Secure VPNs.^[22]

Consider disabling functions from web technologies such as PHP’sevaI() that may be abused for web shells.^[78]

Enforce the principle of least privilege by limiting privileges of user accounts so only authorized accounts can modify the web directory.^[79]

Unexpected file creation in web directories followed by web server processes (e.g., w3wp.exe) spawning command shells or script interpreters (e.g., cmd.exe, powershell.exe)

File creation of unauthorized script (e.g., .php, .sh) in /var/www/html followed by execution of unexpected system utilities (e.g., curl, bash, nc) by apache/nginx

Web servers (e.g., httpd) spawning abnormal processes post file upload into /Library/WebServer/Documents or /usr/local/var/www