Procedure examples

FrostyGoop Incident deployed a ReGeorg variant web shell to impacted systems following initial access for persistence.

During SharePoint ToolShell Exploitation, threat actors followed exploitation of SharePoint servers with installation of a malicious .aspx web shell (spinstall0.aspx) that was written to the `_layouts/15/` directory, granting persistent HTTP-based access.

During Cutting Edge, threat actors used multiple web shells to maintain presence on compromised Connect Secure appliances such as WIREFIRE, GLASSTOKEN, BUSHWALK, LIGHTWIRE, and FRAMESTING.

During Operation Digital Eye, threat actors deployed a PHP-based webshell to maintain persistent access.

For HomeLand Justice, threat actors used .aspx webshells named pickers.aspx, error4.aspx, and ClientBin.aspx, to maintain persistence.

During the C0032 campaign, TEMP.Veles planted Web shells on Outlook Exchange servers.

During Operation CuckooBees, the threat actors generated a web shell within a vulnerable Enterprise Resource Planning Web Application Server as a persistence mechanism.

APT41 DUST involved use of web shells such as ANTSWORD and BLUEBEAM for persistence.

Versa Director Zero Day Exploitation resulted in the deployment of the VersaMem web shell for follow-on activity.

During Operation Wocao, threat actors used their own web shells, as well as those previously placed on target systems by other threat actors, for reconnaissance and lateral movement.

Leviathan relied extensively on web shell use following initial access for persistence and command execution purposes in victim environments during Leviathan Australian Intrusions.

During C0017, APT41 deployed JScript web shells through the creation of malicious ViewState objects.

During the 2022 Ukraine Electric Power Attack, Sandworm Team deployed the Neo-REGEORG webshell on an internet-facing server.