Forensia CTI Core

About

Adversaries may backdoor web servers with web shells to establish persistent access to systems. A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to access the Web server as a gateway into a network. A Web shell may provide a set of functions to execute or a command-line interface on the system that hosts the Web server. In addition to a server-side script, a Web shell may have a client interface program that is used to talk to the Web server (e.g. China Chopper Web shell client).

Platforms: Linux, macOS, Network Devices, WindowsParent: T1505 Server Software ComponentMITRE ATT&CK ↗

Software

22 malware/tools implement this

China ChopperOwaAuthASPXSpySEASHARPEESUPERNOVAP.A.S. WebshellPULSECHECKSLIGHTPULSESTEADYPULSERAPIDPULSEWIREFIREGLASSTOKENBUSHWALKLIGHTWIREFRAMESTINGSnappyTCPreGeorgLine RunnerNeo-reGeorgPHASEJAMSPAWNCHIMERAPHPsert

Corpus indicators tagged with this technique

268 indicators in the corpus carry T1505.003.

Indicator	Type	Family	Sev	Src
cve-2025-12057	cve	—	85	1
cve-2021-27076	cve	—	85	1
cve-2026-3844	cve	—	85	1
cve-2025-34085	cve	—	85	1
cve-2023-44976	cve	ransomware	85	2
cve-2022-47945	cve	—	85	1
cve-2021-29441	cve	—	85	1
cve-2026-0740	cve	—	85	1
cve-2025-7443	cve	—	85	1
cve-2025-7852	cve	—	85	1
cve-2026-1969	cve	—	85	1
1344e6bc51cea35befb4adff7a25899b	hash	ransomware	80	2
00e195d94d3b1f7092eb9ed132f89d1b	hash	—	80	3
10824d14c814524155f2b529cf5fee43	hash	ransomware	80	2
ebcf977806f68af3147e0b78b55f6aed	hash	—	80	2
242038139842ec79ec1044c64eb0804a	hash	ransomware	80	2
cc19e502e4201cc974c753b96429027925224f53	hash	—	80	2
18821dbb53892d6faa14b1f063517a0302057290	hash	cryptojacking	80	1
9c44bc9373377831c45dd0ac2661a28e	hash	—	80	3
6dfef58ef68fb7965a23da8be3141af9	hash	ransomware	80	2
b8eed63ab9cbdca494f26a6f66bfd4a0a693b3f0	hash	—	80	3
56d1de3159adbfda20aca593c99901f9	hash	ransomware	80	2
2654c08491a0f7c4a3dfc6282de5638b	hash	—	80	3
123e80a34508c4dede7cc70e76931fcc	hash	—	80	3
01e3dce00ea45829bd9f6a583004976ac63973a0	hash	cryptojacking	80	1
dce5df29bddff5a4ddaea5c4fec14da91f7b69063a6e1c45ed61e5da4fc6c87b	sha256	—	80	2
625b6535321d58bb5c613e85332bf731	hash	—	80	3
6a5f9bd0e4a0c385b98cc7b528be53a95ff9c4ccffa8c1f65448ab792a46186c	sha256	—	80	1
0b1870d57221eec6f3bbef648e71a724	hash	ransomware	80	2
f4d77958a12a0778283d3e679b24b18f82e332c4	hash	—	80	3

Showing the top 30 by severity of 268.