Procedure examples

APT38 has used web shells for persistence or to ensure redundant access.

BlackByte has used ASPX web shells following exploitation of vulnerabilities in services such as Microsoft Exchange.

GALLIUM used Web shells to persist in victim environments and assist in execution and exfiltration.

Kimsuky has used modified versions of open source PHP web shells to maintain access, often adding "Dinosaur" references within the code.

Volt Typhoon has used webshells, including ones named AuditReport.jspx and iisstart.aspx, in compromised environments.

Dragonfly has commonly created Web shells on victims' publicly accessible email and web servers, which they used to maintain access to a victim network and download additional malicious files.

APT32 has used Web shells to maintain access to victim websites.

HAFNIUM has deployed multiple web shells on compromised servers including SIMPLESEESHARP, SPORTSBALL, China Chopper, and ASPXSpy.

Sandworm Team has used webshells including P.A.S. Webshell to maintain access to victim networks.

CURIUM has been linked to web shells following likely server compromise as an initial access vector into victim networks.

Mustang Panda has used China Chopper web shells to maintain access to victims’ environments.

APT39 has installed ANTAK and ASPXSPY web shells.

Moses Staff has dropped a web shell onto a compromised system.

OilRig has used web shells, often to maintain access to a victim network.

Tropic Trooper has started a web service in the target host and wait for the adversary to connect, acting as a web shell.

Sea Turtle deployed the SnappyTCP web shell during intrusion operations.

Leviathan relies on web shells for an initial foothold as well as persistence into the victim's systems.

APT29 has installed web shells on exploited Microsoft Exchange servers.

Medusa Group has utilized webshells to an exploited Microsoft Exchange Server.

BackdoorDiplomacy has used web shells to establish an initial foothold and for lateral movement within a victim's system.

Deep Panda uses Web shells on publicly accessible Web servers to access victim networks.

Ember Bear deploys web shells following initial access for either follow-on command execution or protocol tunneling. Example web shells used by Ember Bear include P0wnyshell, reGeorg, P.A.S. Webshell, and custom variants of publicly-available web shell examples.

Volatile Cedar can inject web shell code into a server.

Agrius typically deploys a variant of the ASPXSpy web shell following initial access via exploitation.

APT28 has used a modified and obfuscated version of the reGeorg web shell to maintain persistence on a target's Outlook Web Access (OWA) server.

APT5 has installed multiple web shells on compromised servers including on Pulse Secure VPN appliances.

Fox Kitten has installed web shells on compromised hosts to maintain access.

Tonto Team has used a first stage web shell after compromising a vulnerable Exchange server.

Magic Hound has used multiple web shells to gain execution.

Threat Group-3390 has used a variety of Web shells.

FIN13 has utilized obfuscated and open-source web shells such as JspSpy, reGeorg, MiniWebCmdShell, and Vonloesch Jsp File Browser 1.2 to enable remote code execution and to execute commands on compromised web server.