WP-SHELLSTORM: Webshell Access Brokerage Operation
A cybercrime operation that breaks into websites at scale, plants webshell backdoors, and packages access for resale. Targeted WordPress and Joomla sites…
Tag: backdoor
BestShell: Open-Source Chinese Webshell
An open-source Chinese webshell from which the WP-SHELLSTORM main backdoor (down.php) was derived. It allows file management, command execution, reverse shells, and…
GigaWiper: Destructive Backdoor with Disk-Wiping Capabilities
GigaWiper is a post-compromise backdoor detailed by Microsoft that can wipe disks, overwrite Windows drives, or run fake ransomware. It also includes…
China-Linked UAT-7810 Expands ORB Network With New LONGLEASH Malware
A Chinese threat actor tracked as UAT-7810 is actively refining its bespoke malware to expand its Operational Relay Box (ORB) network by…
LONGLEASH: New Backdoor Framework by UAT-7810
LONGLEASH is a full-fledged backdoor framework developed by Chinese APT UAT-7810 as a successor to ShortLeash. It includes an executor component that…
ShortLeash: Custom Backdoor Used by UAT-7810
ShortLeash is a custom backdoor developed by Chinese APT UAT-7810 that can contact an external server, host a web server, and act…
DOGLEASH: Passive Backdoor for Linux Devices
DOGLEASH is a passive backdoor that can execute arbitrary shellcode on a compromised Linux device. It was deployed by UAT-7810 against compromised…
JARLEASH: Java-Based Backdoor for Administration
JARLEASH is a Java-based (JAR package) backdoor deployed by UAT-7810 for administration purposes, including file management, FTP, SFTP, and Netcat. It was…
CERT/CC Warns of Hidden Admin Backdoor in Tenda Router Firmware
The CERT Coordination Center (CERT/CC) has issued a warning about an undocumented authentication backdoor in multiple versions of Tenda router firmware. The…
MINIRECON: Toneshell Variant Backdoor
MINIRECON is a reworked variant of the Toneshell backdoor, beaconing over WebSocket on HTTPS, used by Mustang Panda.