S1189 Neo-reGeorg
Neo-reGeorg is an open-source web shell designed as a restructuring of reGeorg with improved usability, security, and fixes for exising reGeorg bugs.1
| Item | Value |
|---|---|
| ID | S1189 |
| Associated Names | |
| Type | MALWARE |
| Version | 1.0 |
| Created | 06 January 2025 |
| Last Modified | 15 April 2025 |
| Navigation Layer | View In ATT&CK® Navigator |
Techniques Used
| Domain | ID | Name | Use |
|---|---|---|---|
| enterprise | T1071 | Application Layer Protocol | - |
| enterprise | T1071.001 | Web Protocols | Neo-reGeorg can use customized HTTP headers.1 |
| enterprise | T1059 | Command and Scripting Interpreter | - |
| enterprise | T1059.006 | Python | Neo-reGeorg is a Python-based web shell.1 |
| enterprise | T1132 | Data Encoding | - |
| enterprise | T1132.002 | Non-Standard Encoding | Neo-reGeorg can use modified Base64 encoding to obfuscate communications.1 |
| enterprise | T1105 | Ingress Tool Transfer | Neo-reGeorg has the ability to download files to targeted systems.1 |
| enterprise | T1095 | Non-Application Layer Protocol | Neo-reGeorg can create multiple TCP connections for a single session.1 |
| enterprise | T1572 | Protocol Tunneling | Neo-reGeorg can tunnel data in and out of targeted networks.1 |
| enterprise | T1090 | Proxy | Neo-reGeorg has the ability to establish a SOCKS5 proxy on a compromised web server.1 |
| enterprise | T1505 | Server Software Component | - |
| enterprise | T1505.003 | Web Shell | Neo-reGeorg can be installed on compromised web servers to tunnel C2 connections.12 |
Groups That Use This Software
| ID | Name | References |
|---|---|---|
| G0034 | Sandworm Team | 2 |
References
-
L-Codes. (2019). Neo-reGeorg. Retrieved December 4, 2024. ↩↩↩↩↩↩↩↩↩
-
Ken Proska, John Wolfram, Jared Wilson, Dan Black, Keith Lunden, Daniel Kapellmann Zafra, Nathan Brubaker, Tyler Mclellan, Chris Sistrunk. (2023, November 9). Sandworm Disrupts Power in Ukraine Using a Novel Attack Against Operational Technology. Retrieved March 28, 2024. ↩↩