Skip to content

S0020 China Chopper

China Chopper is a Web Shell hosted on Web servers to provide access back into an enterprise network that does not rely on an infected system calling back to a remote command and control server.5 It has been used by several threat groups.2413

Item Value
ID S0020
Associated Names
Type MALWARE
Version 2.4
Created 31 May 2017
Last Modified 10 April 2023
Navigation Layer View In ATT&CK® Navigator

Techniques Used

Domain ID Name Use
enterprise T1071 Application Layer Protocol -
enterprise T1071.001 Web Protocols China Chopper‘s server component executes code sent via HTTP POST commands.4
enterprise T1110 Brute Force -
enterprise T1110.001 Password Guessing China Chopper‘s server component can perform brute force password guessing against authentication portals.4
enterprise T1059 Command and Scripting Interpreter -
enterprise T1059.003 Windows Command Shell China Chopper‘s server component is capable of opening a command terminal.756
enterprise T1005 Data from Local System China Chopper‘s server component can upload local files.4563
enterprise T1083 File and Directory Discovery China Chopper‘s server component can list directory contents.43
enterprise T1070 Indicator Removal -
enterprise T1070.006 Timestomp China Chopper‘s server component can change the timestamp of files.456
enterprise T1105 Ingress Tool Transfer China Chopper‘s server component can download remote files.4563
enterprise T1046 Network Service Discovery China Chopper‘s server component can spider authentication portals.4
enterprise T1027 Obfuscated Files or Information -
enterprise T1027.002 Software Packing China Chopper‘s client component is packed with UPX.5
enterprise T1505 Server Software Component -
enterprise T1505.003 Web Shell China Chopper‘s server component is a Web Shell payload.5

Groups That Use This Software

ID Name References
G0117 Fox Kitten 8
G0093 GALLIUM 910
G0125 HAFNIUM 12113
G0065 Leviathan 4113
G0135 BackdoorDiplomacy 14
G0096 APT41 15
G0027 Threat Group-3390 271617

References

  1. CISA. (2021, July 19). (AA21-200A) Joint Cybersecurity Advisory – Tactics, Techniques, and Procedures of Indicted APT40 Actors Associated with China’s MSS Hainan State Security Department. Retrieved August 12, 2021. ↩↩

  2. Dell SecureWorks Counter Threat Unit Threat Intelligence. (2015, August 5). Threat Group-3390 Targets Organizations for Cyberespionage. Retrieved August 18, 2018. ↩↩

  3. Eoin Miller. (2021, March 23). Defending Against the Zero Day: Analyzing Attacker Behavior Post-Exploitation of Microsoft Exchange. Retrieved October 27, 2022. ↩↩↩↩↩

  4. FireEye. (2018, March 16). Suspected Chinese Cyber Espionage Group (TEMP.Periscope) Targeting U.S. Engineering and Maritime Industries. Retrieved April 11, 2018. ↩↩↩↩↩↩↩↩↩

  5. Lee, T., Hanzlik, D., Ahl, I. (2013, August 7). Breaking Down the China Chopper Web Shell - Part I. Retrieved March 27, 2015. ↩↩↩↩↩↩↩

  6. The Australian Cyber Security Centre (ACSC), the Canadian Centre for Cyber Security (CCCS), the New Zealand National Cyber Security Centre (NZ NCSC), CERT New Zealand, the UK National Cyber Security Centre (UK NCSC) and the US National Cybersecurity and Communications Integration Center (NCCIC). (2018, October 11). Joint report on publicly available hacking tools. Retrieved March 11, 2019. ↩↩↩↩

  7. Counter Threat Unit Research Team. (2017, June 27). BRONZE UNION Cyberespionage Persists Despite Disclosures. Retrieved July 13, 2017. ↩↩

  8. CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020. ↩

  9. Cybereason Nocturnus. (2019, June 25). Operation Soft Cell: A Worldwide Campaign Against Telecommunications Providers. Retrieved July 18, 2019. ↩

  10. MSTIC. (2019, December 12). GALLIUM: Targeting global telecom. Retrieved January 13, 2021. ↩

  11. Bromiley, M. et al. (2021, March 4). Detection and Response to Exploitation of Microsoft Exchange Zero-Day Vulnerabilities. Retrieved March 9, 2021. ↩

  12. Gruzweig, J. et al. (2021, March 2). Operation Exchange Marauder: Active Exploitation of Multiple Zero-Day Microsoft Exchange Vulnerabilities. Retrieved March 3, 2021. ↩

  13. Accenture iDefense Unit. (2019, March 5). Mudcarp’s Focus on Submarine Technologies. Retrieved August 24, 2021. ↩

  14. Adam Burgher. (2021, June 10). BackdoorDiplomacy: Upgrading from Quarian to Turian. Retrieved September 1, 2021 ↩

  15. Fraser, N., et al. (2019, August 7). Double DragonAPT41, a dual espionage and cyber crime operation APT41. Retrieved September 23, 2019. ↩

  16. Pantazopoulos, N., Henry T. (2018, May 18). Emissary Panda – A potential new malicious tool. Retrieved June 25, 2018. ↩

  17. Falcone, R. and Lancaster, T. (2019, May 28). Emissary Panda Attacks Middle East Government Sharepoint Servers. Retrieved July 9, 2019. ↩