CyberSecurityBoardThreat Intel · CVEs · Products
Malware

RelayShell: PHP Web Shell Deployed on Roundcube Servers

August 12, 2026

RelayShell is a previously undocumented PHP web shell used by Lazarus Group to compromise Roundcube webmail servers. It enables command and response exchange via text files, turning the servers into stealthy C2 infrastructure.