P.A.S. Webshell
Software · ATTACK:enterprise:S0598
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0598",
"title": "P.A.S. Webshell",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0598",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--4800d0f9-00aa-47cd-a4d2-92198585b8fd",
"external_id": "S0598",
"domain": "enterprise",
"created": "2021-04-13T12:46:58.579Z",
"modified": "2025-04-25T14:43:11.044Z",
"version": "1.0",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "Fobushell"
},
{
"source_name": "ANSSI Sandworm January 2021",
"url": "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
},
{
"source_name": "NCCIC AR-17-20045 February 2017",
"url": "https://us-cert.cisa.gov/sites/default/files/publications/AR-17-20045_Enhanced_Analysis_of_GRIZZLY_STEPPE_Activity.pdf"
}
]
}Explicit source assertions (17)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0598 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0686ee2f-ff46-418b-b6e8-1766e4dc33a8
ANSSI Sandworm January 2021ATTACK:enterprise:S0598 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--093bc793-3edd-4096-bd7b-aeb5c855128b
ANSSI Sandworm January 2021ATTACK:enterprise:S0598 → uses → ATTACK:enterprise:T1505.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0b41b24d-3a8b-4d73-95bf-9b5b486978d8
ANSSI Sandworm January 2021ATTACK:enterprise:G1003 → uses → ATTACK:enterprise:S0598
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0b703c87-b5a9-4e54-9db9-23d7288c2060
CISA GRU29155 2024ATTACK:enterprise:S0598 → uses → ATTACK:enterprise:T1005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1a0117d8-422f-48ed-be65-9d2fcaf12ed9
ANSSI Sandworm January 2021ATTACK:enterprise:S0598 → uses → ATTACK:enterprise:T1222.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3062f5f2-8a0d-4a1b-ac64-aa6c3b06a1a5
ANSSI Sandworm January 2021ATTACK:enterprise:S0598 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4901215f-3cfb-4db3-9afb-4d063c1eb83a
ANSSI Sandworm January 2021ATTACK:enterprise:G0034 → uses → ATTACK:enterprise:S0598
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--53da73de-7983-4517-8e59-a1b305fcfac0
ANSSI Sandworm January 2021ATTACK:enterprise:S0598 → uses → ATTACK:enterprise:T1059
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7e3bdb4d-76b3-42ce-8f68-587320e39ec7
ANSSI Sandworm January 2021ATTACK:enterprise:S0598 → uses → ATTACK:enterprise:T1518
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--87e99b39-e634-477e-b260-6098abc58dc2
ANSSI Sandworm January 2021ATTACK:enterprise:S0598 → uses → ATTACK:enterprise:T1027
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8c73e0be-f105-4f22-93b4-cb765fb8f419
ANSSI Sandworm January 2021ATTACK:enterprise:S0598 → uses → ATTACK:enterprise:T1070.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9cbb4f4c-c25f-42c4-a5ba-52e70a6654bd
ANSSI Sandworm January 2021ATTACK:enterprise:S0598 → uses → ATTACK:enterprise:T1046
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a0bb2dec-515f-4334-97c1-63fa6c9b4340
ANSSI Sandworm January 2021ATTACK:enterprise:S0598 → uses → ATTACK:enterprise:T1213.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cba11c5f-afe2-42e1-8995-8b1105d75e7a
ANSSI Sandworm January 2021ATTACK:enterprise:S0598 → uses → ATTACK:enterprise:T1110.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ed00df58-4656-4c62-8ef1-8b859f46c1ed
ANSSI Sandworm January 2021ATTACK:enterprise:S0598 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f77760d0-35c1-4e91-98b9-2ac57ba183d5
ANSSI Sandworm January 2021ATTACK:enterprise:S0598 → uses → ATTACK:enterprise:T1087.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f78eb569-6e16-4103-bc17-265f2d1b1bb2
ANSSI Sandworm January 2021