Adversaries may backdoor web servers with web shells to establish persistent access to systems. A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to access the Web server as a gateway into a network. A Web shell may provide a set of functions to execute or a command-line interface on the system that hosts the Web server.1 In addition to a server-side script, a Web shell may have a client interface program that is used to talk to the Web server (e.g. China Chopper Web shell client).2
- volexity_0day_sophos_FW
- Lee 2013
使用该技术的组织
| 组织 | 名称 | 国家 |
|---|---|---|
| grp_g0123 | Volatile Cedar | Lebanon |
| grp_g1030 | Agrius | Iran |
| grp_g1009 | Moses Staff | Iran |
| grp_g1043 | BlackByte | — |
| grp_g0117 | Fox Kitten | — |
| grp_g1023 | APT5 | China |
| grp_g0009 | Deep Panda | China |
| grp_g0129 | Mustang Panda | China |
| grp_g1041 | Sea Turtle | — |
| grp_g0135 | BackdoorDiplomacy | — |
| grp_g0093 | GALLIUM | — |
| grp_g1051 | Medusa Group | — |
| grp_g0035 | Dragonfly | Russia |
| grp_g0131 | Tonto Team | China |
| grp_g0049 | OilRig | Iran |
| grp_g1012 | CURIUM | Iran |
| grp_g1017 | Volt Typhoon | — |
| grp_g0082 | APT38 | DPRK |
| grp_g0081 | Tropic Trooper | — |
| grp_g0065 | Leviathan | China |
| grp_g0087 | APT39 | — |
| grp_g0125 | HAFNIUM | — |
| grp_g0094 | Kimsuky | DPRK |
| grp_g0059 | Magic Hound | Iran |
| grp_g1016 | FIN13 | — |
| grp_g1003 | Ember Bear | Russia |
| grp_g0007 | APT28 | Russia |
| grp_g0016 | APT29 | Russia |
| grp_g0027 | Threat Group-3390 | China |
| grp_g0034 | Sandworm Team | Russia |
| grp_g0050 | APT32 | Vietnam |
断言
尚无指向该技术的公开断言。
记录自动入库·未人工复核；置信度与有效期按引用读取。