Skip to content

T1505.003 Web Shell

Adversaries may backdoor web servers with web shells to establish persistent access to systems. A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to access the Web server as a gateway into a network. A Web shell may provide a set of functions to execute or a command-line interface on the system that hosts the Web server.2

In addition to a server-side script, a Web shell may have a client interface program that is used to talk to the Web server (e.g. China Chopper Web shell client).3

Item Value
ID T1505.003
Sub-techniques T1505.001, T1505.002, T1505.003, T1505.004, T1505.005, T1505.006
Tactics TA0003
Platforms Linux, Network Devices, Windows, macOS
Version 1.5
Created 13 December 2019
Last Modified 24 October 2025

Procedure Examples

ID Name Description
C0034 2022 Ukraine Electric Power Attack During the 2022 Ukraine Electric Power Attack, Sandworm Team deployed the Neo-REGEORG webshell on an internet-facing server.12
G1030 Agrius Agrius typically deploys a variant of the ASPXSpy web shell following initial access via exploitation.32
G0007 APT28 APT28 has used a modified and obfuscated version of the reGeorg web shell to maintain persistence on a target’s Outlook Web Access (OWA) server.26
G0016 APT29 APT29 has installed web shells on exploited Microsoft Exchange servers.5522
G0050 APT32 APT32 has used Web shells to maintain access to victim websites.60
G0082 APT38 APT38 has used web shells for persistence or to ensure redundant access.54
G0087 APT39 APT39 has installed ANTAK and ASPXSPY web shells.34
C0040 APT41 DUST APT41 DUST involved use of web shells such as ANTSWORD and BLUEBEAM for persistence.76
G1023 APT5 APT5 has installed multiple web shells on compromised servers including on Pulse Secure VPN appliances.1114
S0073 ASPXSpy ASPXSpy is a Web shell. The ASPXTool version used by Threat Group-3390 has been deployed to accessible servers running Internet Information Services (IIS).8
G0135 BackdoorDiplomacy BackdoorDiplomacy has used web shells to establish an initial foothold and for lateral movement within a victim’s system.31
G1043 BlackByte BlackByte has used ASPX web shells following exploitation of vulnerabilities in services such as Microsoft Exchange.5859
S1118 BUSHWALK BUSHWALK is a web shell that has the ability to execute arbitrary commands or write files.10
C0017 C0017 During C0017, APT41 deployed JScript web shells through the creation of malicious ViewState objects.73
C0032 C0032 During the C0032 campaign, TEMP.Veles planted Web shells on Outlook Exchange servers.75
S0020 China Chopper China Chopper’s server component is a Web Shell payload.3
G1012 CURIUM CURIUM has been linked to web shells following likely server compromise as an initial access vector into victim networks.24
C0029 Cutting Edge During Cutting Edge, threat actors used multiple web shells to maintain presence on compromised Connect Secure appliances such as WIREFIRE, GLASSTOKEN, BUSHWALK, LIGHTWIRE, and FRAMESTING.921
G0009 Deep Panda Deep Panda uses Web shells on publicly accessible Web servers to access victim networks.33
G0035 Dragonfly Dragonfly has commonly created Web shells on victims’ publicly accessible email and web servers, which they used to maintain access to a victim network and download additional malicious files.25
G1003 Ember Bear Ember Bear deploys web shells following initial access for either follow-on command execution or protocol tunneling. Example web shells used by Ember Bear include P0wnyshell, reGeorg, P.A.S. Webshell, and custom variants of publicly-available web shell examples.2342
G1016 FIN13 FIN13 has utilized obfuscated and open-source web shells such as JspSpy, reGeorg, MiniWebCmdShell, and Vonloesch Jsp File Browser 1.2 to enable remote code execution and to execute commands on compromised web server.30
G0117 Fox Kitten Fox Kitten has installed web shells on compromised hosts to maintain access.5051
S1120 FRAMESTING FRAMESTING is a web shell capable of enabling arbitrary command execution on compromised Ivanti Connect Secure VPNs.10
C0041 FrostyGoop Incident FrostyGoop Incident deployed a ReGeorg variant web shell to impacted systems following initial access for persistence.74
G0093 GALLIUM GALLIUM used Web shells to persist in victim environments and assist in execution and exfiltration.3839
S1117 GLASSTOKEN GLASSTOKEN is a web shell capable of tunneling C2 connections and code execution on compromised Ivanti Secure Connect VPNs.21
G0125 HAFNIUM HAFNIUM has deployed multiple web shells on compromised servers including SIMPLESEESHARP, SPORTSBALL, China Chopper, and ASPXSpy.484543474446
C0038 HomeLand Justice For HomeLand Justice, threat actors used .aspx webshells named pickers.aspx, error4.aspx, and ClientBin.aspx, to maintain persistence.7778
G0094 Kimsuky Kimsuky has used modified versions of open source PHP web shells to maintain access, often adding “Dinosaur” references within the code.66
G0065 Leviathan Leviathan relies on web shells for an initial foothold as well as persistence into the victim’s systems.646362
C0049 Leviathan Australian Intrusions Leviathan relied extensively on web shell use following initial access for persistence and command execution purposes in victim environments during Leviathan Australian Intrusions.62
S1119 LIGHTWIRE LIGHTWIRE is a web shell capable of command execution and establishing persistence on compromised Ivanti Secure Connect VPNs.10
S1188 Line Runner Line Runner is a persistent Lua-based web shell.15
G0059 Magic Hound Magic Hound has used multiple web shells to gain execution.5756
G1051 Medusa Group Medusa Group has utilized webshells to an exploited Microsoft Exchange Server.61
G1009 Moses Staff Moses Staff has dropped a web shell onto a compromised system.49
G0129 Mustang Panda Mustang Panda has used China Chopper web shells to maintain access to victims’ environments.35
S1189 Neo-reGeorg Neo-reGeorg can be installed on compromised web servers to tunnel C2 connections.1312
G0049 OilRig OilRig has used web shells, often to maintain access to a victim network.29202728
C0012 Operation CuckooBees During Operation CuckooBees, the threat actors generated a web shell within a vulnerable Enterprise Resource Planning Web Application Server as a persistence mechanism.79
C0014 Operation Wocao During Operation Wocao, threat actors used their own web shells, as well as those previously placed on target systems by other threat actors, for reconnaissance and lateral movement.80
S0072 OwaAuth OwaAuth is a Web shell that appears to be exclusively used by Threat Group-3390. It is installed as an ISAPI filter on Exchange servers and shares characteristics with the China Chopper Web shell.8
S0598 P.A.S. Webshell P.A.S. Webshell can gain remote access and execution on target web servers.7
S1108 PULSECHECK PULSECHECK is a web shell that can enable command execution on compromised servers.11
S1113 RAPIDPULSE RAPIDPULSE is a web shell that is capable of arbitrary file read on targeted web servers to exfiltrate items of interest on the victim device.14
S1187 reGeorg reGeorg is a web shell that has been installed on exposed web servers for access to victim environments.2223
G0034 Sandworm Team Sandworm Team has used webshells including P.A.S. Webshell to maintain access to victim networks.7
G1041 Sea Turtle Sea Turtle deployed the SnappyTCP web shell during intrusion operations.1965
S0185 SEASHARPEE SEASHARPEE is a Web shell.20
C0058 SharePoint ToolShell Exploitation
During SharePoint ToolShell Exploitation, threat actors followed exploitation of SharePoint servers with installation of a malicious .aspx web shell (spinstall0.aspx) that was written to the _layouts/15/ directory, granting persistent HTTP-based access.716869677072
S1110 SLIGHTPULSE SLIGHTPULSE is a web shell that can read, write, and execute files on compromised servers.11
S1163 SnappyTCP SnappyTCP is a reverse TCP shell with command and control capabilities used for persistence purposes.19
S1112 STEADYPULSE STEADYPULSE is a web shell that can enable the execution of arbitrary commands on compromised web servers.11
S0578 SUPERNOVA SUPERNOVA is a Web shell.161718
G0027 Threat Group-3390 Threat Group-3390 has used a variety of Web shells.40
G0131 Tonto Team Tonto Team has used a first stage web shell after compromising a vulnerable Exchange server.52
G0081 Tropic Trooper Tropic Trooper has started a web service in the target host and wait for the adversary to connect, acting as a web shell.41
C0039 Versa Director Zero Day Exploitation Versa Director Zero Day Exploitation resulted in the deployment of the VersaMem web shell for follow-on activity.81
G0123 Volatile Cedar Volatile Cedar can inject web shell code into a server.3637
G1017 Volt Typhoon Volt Typhoon has used webshells, including ones named AuditReport.jspx and iisstart.aspx, in compromised environments.53
S1115 WIREFIRE WIREFIRE is a web shell that can download files to and execute arbitrary commands from compromised Ivanti Connect Secure VPNs.9

Mitigations

ID Mitigation Description
M1042 Disable or Remove Feature or Program Consider disabling functions from web technologies such as PHP’s evaI() that may be abused for web shells.5
M1018 User Account Management Enforce the principle of least privilege by limiting privileges of user accounts so only authorized accounts can modify the web directory.6

References

  1. NSA Cybersecurity Directorate. (n.d.). Mitigating Web Shells. Retrieved July 22, 2021. ↩

  2. Adair, S., Lancaster, T., Volexity Threat Research. (2022, June 15). DriftingCloud: Zero-Day Sophos Firewall Exploitation and an Insidious Breach. Retrieved July 1, 2022. ↩

  3. Lee, T., Hanzlik, D., Ahl, I. (2013, August 7). Breaking Down the China Chopper Web Shell - Part I. Retrieved March 27, 2015. ↩↩

  4. US-CERT. (2015, November 13). Compromised Web Servers and Web Shells - Threat Awareness and Guidance. Retrieved June 8, 2016. ↩

  5. Kondratiev, A. (n.d.). Disabling dangerous PHP functions. Retrieved July 26, 2021. ↩

  6. NSA and ASD. (2020, April 3). Detect and Prevent Web Shell Malware. Retrieved July 23, 2021. ↩

  7. ANSSI. (2021, January 27). SANDWORM INTRUSION SET CAMPAIGN TARGETING CENTREON SYSTEMS. Retrieved March 30, 2021. ↩↩

  8. Dell SecureWorks Counter Threat Unit Threat Intelligence. (2015, August 5). Threat Group-3390 Targets Organizations for Cyberespionage. Retrieved August 18, 2018. ↩↩

  9. McLellan, T. et al. (2024, January 12). Cutting Edge: Suspected APT Targets Ivanti Connect Secure VPN in New Zero-Day Exploitation. Retrieved February 27, 2024. ↩↩

  10. Lin, M. et al. (2024, January 31). Cutting Edge, Part 2: Investigating Ivanti Connect Secure VPN Zero-Day Exploitation. Retrieved February 27, 2024. ↩↩↩

  11. Perez, D. et al. (2021, April 20). Check Your Pulse: Suspected APT Actors Leverage Authentication Bypass Techniques and Pulse Secure Zero-Day. Retrieved February 5, 2024. ↩↩↩↩

  12. Ken Proska, John Wolfram, Jared Wilson, Dan Black, Keith Lunden, Daniel Kapellmann Zafra, Nathan Brubaker, Tyler Mclellan, Chris Sistrunk. (2023, November 9). Sandworm Disrupts Power in Ukraine Using a Novel Attack Against Operational Technology. Retrieved March 28, 2024. ↩↩

  13. L-Codes. (2019). Neo-reGeorg. Retrieved December 4, 2024. ↩

  14. Perez, D. et al. (2021, May 27). Re-Checking Your Pulse: Updates on Chinese APT Actors Compromising Pulse Secure VPN Devices. Retrieved February 5, 2024. ↩↩

  15. Canadian Centre for Cyber Security. (2024, April 24). Cyber Activity Impacting CISCO ASA VPNs. Retrieved January 6, 2025. ↩

  16. Tennis, M. (2020, December 17). SUPERNOVA: A Novel .NET Webshell. Retrieved February 22, 2021. ↩

  17. Riley, W. (2020, December 1). SUPERNOVA SolarWinds .NET Webshell Analysis. Retrieved February 18, 2021. ↩

  18. CISA. (2021, January 27). Malware Analysis Report (AR21-027A). Retrieved February 22, 2021. ↩

  19. PwC Threat Intelligence. (2023, December 5). The Tortoise and The Malware. Retrieved November 20, 2024. ↩↩

  20. Davis, S. and Caban, D. (2017, December 19). APT34 - New Targeted Attack in the Middle East. Retrieved December 20, 2017. ↩↩

  21. Meltzer, M. et al. (2024, January 10). Active Exploitation of Two Zero-Day Vulnerabilities in Ivanti Connect Secure VPN. Retrieved February 27, 2024. ↩↩

  22. Mandiant. (2022, May 2). UNC3524: Eye Spy on Your Email. Retrieved August 17, 2023. ↩↩

  23. Microsoft Threat Intelligence. (2023, June 14). Cadet Blizzard emerges as a novel and distinct Russian threat actor. Retrieved July 10, 2023. ↩↩

  24. Symantec Threat Hunter Team. (2019, September 18). Tortoiseshell Group Targets IT Providers in Saudi Arabia in Probable Supply Chain Attacks. Retrieved May 20, 2024. ↩

  25. US-CERT. (2018, March 16). Alert (TA18-074A): Russian Government Cyber Activity Targeting Energy and Other Critical Infrastructure Sectors. Retrieved June 6, 2018. ↩

  26. NSA, CISA, FBI, NCSC. (2021, July). Russian GRU Conducting Global Brute Force Campaign to Compromise Enterprise and Cloud Environments. Retrieved July 26, 2021. ↩

  27. Crowdstrike. (2020, March 2). 2020 Global Threat Report. Retrieved December 11, 2020. ↩

  28. Fahmy, M. et al. (2024, October 11). Earth Simnavaz (aka APT34) Levies Advanced Cyberattacks Against Middle East. Retrieved November 27, 2024. ↩

  29. Unit42. (2016, May 1). Evasive Serpens Unit 42 Playbook Viewer. Retrieved February 6, 2023. ↩

  30. Sygnia Incident Response Team. (2022, January 5). TG2003: ELEPHANT BEETLE UNCOVERING AN ORGANIZED FINANCIAL-THEFT OPERATION. Retrieved February 9, 2023. ↩

  31. Adam Burgher. (2021, June 10). BackdoorDiplomacy: Upgrading from Quarian to Turian. Retrieved September 1, 2021 ↩

  32. Amitai Ben & Shushan Ehrlich. (2021, May). From Wiper to Ransomware: The Evolution of Agrius. Retrieved May 21, 2024. ↩

  33. RYANJ. (2014, February 20). Mo’ Shells Mo’ Problems – Deep Panda Web Shells. Retrieved September 16, 2015. ↩

  34. Hawley et al. (2019, January 29). APT39: An Iranian Cyber Espionage Group Focused on Personal Information. Retrieved February 19, 2019. ↩

  35. Lior Rochberger, Tom Fakterman, Robert Falcone. (2023, September 22). Cyberespionage Attacks Against Southeast Asian Government Linked to Stately Taurus, Aka Mustang Panda. Retrieved September 9, 2025. ↩

  36. Threat Intelligence and Research. (2015, March 30). VOLATILE CEDAR. Retrieved February 8, 2021. ↩

  37. ClearSky Cyber Security. (2021, January). “Lebanese Cedar” APT Global Lebanese Espionage Campaign Leveraging Web Servers. Retrieved February 10, 2021. ↩

  38. Cybereason Nocturnus. (2019, June 25). Operation Soft Cell: A Worldwide Campaign Against Telecommunications Providers. Retrieved July 18, 2019. ↩

  39. MSTIC. (2019, December 12). GALLIUM: Targeting global telecom. Retrieved January 13, 2021. ↩

  40. Falcone, R. and Lancaster, T. (2019, May 28). Emissary Panda Attacks Middle East Government Sharepoint Servers. Retrieved July 9, 2019. ↩

  41. Chen, J.. (2020, May 12). Tropic Trooper’s Back: USBferry Attack Targets Air gapped Environments. Retrieved May 20, 2020. ↩

  42. US Cybersecurity & Infrastructure Security Agency et al. (2024, September 5). Russian Military Cyber Actors Target U.S. and Global Critical Infrastructure. Retrieved September 6, 2024. ↩

  43. Bromiley, M. et al. (2021, March 4). Detection and Response to Exploitation of Microsoft Exchange Zero-Day Vulnerabilities. Retrieved March 9, 2021. ↩

  44. Eoin Miller. (2021, March 23). Defending Against the Zero Day: Analyzing Attacker Behavior Post-Exploitation of Microsoft Exchange. Retrieved October 27, 2022. ↩

  45. Gruzweig, J. et al. (2021, March 2). Operation Exchange Marauder: Active Exploitation of Multiple Zero-Day Microsoft Exchange Vulnerabilities. Retrieved March 3, 2021. ↩

  46. Microsoft Threat Intelligence . (2025, March 5). Silk Typhoon targeting IT supply chain. Retrieved March 20, 2025. ↩

  47. Microsoft Threat Intelligence Team & Detection and Response Team . (2022, April 12). Tarrask malware uses scheduled tasks for defense evasion. Retrieved June 1, 2022. ↩

  48. MSTIC. (2021, March 2). HAFNIUM targeting Exchange Servers with 0-day exploits. Retrieved March 3, 2021. ↩

  49. Checkpoint Research. (2021, November 15). Uncovering MosesStaff techniques: Ideology over Money. Retrieved August 11, 2022. ↩

  50. CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020. ↩

  51. ClearSky. (2020, December 17). Pay2Key Ransomware – A New Campaign by Fox Kitten. Retrieved December 21, 2020. ↩

  52. Faou, M., Tartare, M., Dupuy, T. (2021, March 10). Exchange servers under siege from at least 10 APT groups. Retrieved May 21, 2021. ↩

  53. Counter Threat Unit Research Team. (2023, May 24). Chinese Cyberespionage Group BRONZE SILHOUETTE Targets U.S. Government and Defense Organizations. Retrieved July 27, 2023. ↩

  54. DHS/CISA. (2020, August 26). FASTCash 2.0: North Korea’s BeagleBoyz Robbing Banks. Retrieved September 29, 2021. ↩

  55. NCSC, CISA, FBI, NSA. (2021, May 7). Further TTPs associated with SVR cyber actors. Retrieved July 29, 2021. ↩

  56. DFIR Report. (2021, November 15). Exchange Exploit Leads to Domain Wide Ransomware. Retrieved January 5, 2023. ↩

  57. DFIR Report. (2022, March 21). APT35 Automates Initial Access Using ProxyShell. Retrieved May 25, 2022. ↩

  58. Huseyin Can Yuceel. (2022, February 21). TTPs used by BlackByte Ransomware Targeting Critical Infrastructure. Retrieved December 16, 2024. ↩

  59. Microsoft Incident Response. (2023, July 6). The five-day job: A BlackByte ransomware intrusion case study. Retrieved December 16, 2024. ↩

  60. Lassalle, D., et al. (2017, November 6). OceanLotus Blossoms: Mass Digital Surveillance and Attacks Targeting ASEAN, Asian Nations, the Media, Human Rights Groups, and Civil Society. Retrieved November 6, 2017. ↩

  61. Anthony Galiette, Doel Santos. (2024, January 11). Medusa Ransomware Turning Your Files into Stone. Retrieved October 15, 2025. ↩

  62. CISA et al. (2024, July 8). People’s Republic of China (PRC) Ministry of State Security APT40 Tradecraft in Action. Retrieved February 3, 2025. ↩↩

  63. CISA. (2021, July 19). (AA21-200A) Joint Cybersecurity Advisory – Tactics, Techniques, and Procedures of Indicted APT40 Actors Associated with China’s MSS Hainan State Security Department. Retrieved August 12, 2021. ↩

  64. Plan, F., et al. (2019, March 4). APT40: Examining a China-Nexus Espionage Actor. Retrieved March 18, 2019. ↩

  65. Hunt & Hackett Research Team. (2024, January 5). Turkish espionage campaigns in the Netherlands. Retrieved November 20, 2024. ↩

  66. CISA, FBI, CNMF. (2020, October 27). https://us-cert.cisa.gov/ncas/alerts/aa20-301a. Retrieved November 4, 2020. ↩

  67. Trend Micro Research. (2022, July 22). Proactive Security Insights for SharePoint Attacks (CVE-2025-53770 and CVE-2025-53771). Retrieved October 15, 2025. ↩

  68. ESET Research. (2025, July 24). ToolShell: An all-you-can-eat buffet for threat actors. Retrieved October 15, 2025. ↩

  69. Eye Security. (2025, July 19). SharePoint Under Siege: ToolShell Exploit (CVE-2025-49706 & CVE-2025-49704). Retrieved October 15, 2025. ↩

  70. Kenin, S. et al. (2025, July 21). SharePoint ToolShell | Zero-Day Exploited in-the-Wild Targets Enterprise Servers. Retrieved October 15, 2025. ↩

  71. Microsoft Threat Intelligence. (2025, July 22). Disrupting active exploitation of on-premises SharePoint vulnerabilities. Retrieved October 15, 2025. ↩

  72. Unit 42. (2025, July 31). Active Exploitation of Microsoft SharePoint Vulnerabilities: Threat Brief (Updated). Retrieved October 15, 2025. ↩

  73. Rufus Brown, Van Ta, Douglas Bienstock, Geoff Ackerman, John Wolfram. (2022, March 8). Does This Look Infected? A Summary of APT41 Targeting U.S. State Governments. Retrieved July 8, 2022. ↩

  74. Mark Graham, Carolyn Ahlers, Kyle O’Meara; Dragos. (2024, July). Impact of FrostyGoop ICS Malware on Connected OT Systems. Retrieved November 20, 2024. ↩

  75. Miller, S, et al. (2019, April 10). TRITON Actor TTP Profile, Custom Attack Tools, Detections, and ATT&CK Mapping. Retrieved April 16, 2019. ↩

  76. Mike Stokkel et al. (2024, July 18). APT41 Has Arisen From the DUST. Retrieved September 16, 2024. ↩

  77. CISA. (2022, September 23). AA22-264A Iranian State Actors Conduct Cyber Operations Against the Government of Albania. Retrieved August 6, 2024. ↩

  78. MSTIC. (2022, September 8). Microsoft investigates Iranian attacks against the Albanian government. Retrieved August 6, 2024. ↩

  79. Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022. ↩

  80. Dantzig, M. v., Schamper, E. (2019, December 19). Operation Wocao: Shining a light on one of China’s hidden hacking groups. Retrieved October 8, 2020. ↩

  81. Black Lotus Labs. (2024, August 27). Taking The Crossroads: The Versa Director Zero-Day Exploitaiton. Retrieved August 27, 2024. ↩