Skip to content

Web Shell

Subtechnique · ATTACK:enterprise:T1505.003

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1505.003",
  "title": "Web Shell",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1505/003",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--5d0d3609-d06d-49e1-b9c9-b544e0c618cb",
  "external_id": "T1505.003",
  "domain": "enterprise",
  "created": "2019-12-13T16:46:18.927Z",
  "modified": "2026-05-12T15:12:00.635Z",
  "version": "1.5",
  "aliases": [

  ],
  "tactics": [
    "persistence"
  ],
  "source_references": [
    {
      "source_name": "NSA Cyber Mitigating Web Shells",
      "url": "https://github.com/nsacyber/Mitigating-Web-Shells"
    },
    {
      "source_name": "volexity_0day_sophos_FW",
      "url": "https://www.volexity.com/blog/2022/06/15/driftingcloud-zero-day-sophos-firewall-exploitation-and-an-insidious-breach/"
    },
    {
      "source_name": "Lee 2013",
      "url": "https://www.fireeye.com/blog/threat-research/2013/08/breaking-down-the-china-chopper-web-shell-part-i.html"
    },
    {
      "source_name": "US-CERT Alert TA15-314A Web Shells",
      "url": "https://www.us-cert.gov/ncas/alerts/TA15-314A"
    }
  ]
}

Explicit source assertions (70)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G1012 → uses → ATTACK:enterprise:T1505.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--08cdde30-5009-43bf-ad02-9330e7bfd0a7

Symantec Tortoiseshell 2019

ATTACK:enterprise:S0598 → uses → ATTACK:enterprise:T1505.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0b41b24d-3a8b-4d73-95bf-9b5b486978d8

ANSSI Sandworm January 2021

ATTACK:enterprise:S0072 → uses → ATTACK:enterprise:T1505.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0dee5507-6e61-4244-86a8-c7e8a34469da

ATTACK:enterprise:G0035 → uses → ATTACK:enterprise:T1505.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--103489a6-af80-4d4d-8aa7-ca973713e8da

US-CERT TA18-074A

ATTACK:enterprise:S9028 → uses → ATTACK:enterprise:T1505.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--12f2d741-15cd-43b0-9c05-06f8295ab547

sentinelone operationDigitalEye Dec 2024

ATTACK:enterprise:C0061 → uses → ATTACK:enterprise:T1505.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--17075ee2-67e9-42dd-a9ab-8d1d4620aab8

sentinelone operationDigitalEye Dec 2024

ATTACK:enterprise:G0007 → uses → ATTACK:enterprise:T1505.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1f6fe0b5-3696-4a76-82c7-b866b1a8269a

Cybersecurity Advisory GRU Brute Force Campaign July 2021

ATTACK:enterprise:S1115 → uses → ATTACK:enterprise:T1505.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2856ba71-fa3d-4aa7-99ae-3438f11b2655

Mandiant Cutting Edge January 2024

ATTACK:enterprise:S9024 → uses → ATTACK:enterprise:T1505.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2a795c6b-e582-473c-ae2d-3e6e8e7c8c72

CISA SPAWNCHIMERA RESURGE February 2026

ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1505.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2dbed740-1b50-4d59-a729-a1d9e6a839df

Crowdstrike GTR2020 Mar 2020 · FireEye APT34 Webinar Dec 2017 · Trend Micro Earth Simnavaz October 2024 · Unit42 OilRig Playbook 2023

ATTACK:enterprise:G1016 → uses → ATTACK:enterprise:T1505.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2ddb50ab-4c8e-41e6-ba3f-d7718c66f0d5

Sygnia Elephant Beetle Jan 2022

ATTACK:enterprise:G0135 → uses → ATTACK:enterprise:T1505.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3740c99a-3d2d-4ea3-ae6e-2a3bfcf572f3

ESET BackdoorDiplomacy Jun 2021

ATTACK:enterprise:C0058 → uses → ATTACK:enterprise:T1505.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3c7dad36-c2dc-4a9d-b0fb-fee2414512b5

Trend Micro SharePoint Attacks JUL 2025 · ESET ToolShell JUL 2025 · Eye Research ToolShell JUL 2025 · SentinelOne ToolShell JUL 2025 · Microsoft SharePoint Exploit JUL 2025 · Palo Alto SharePoint Vulnerabilities JUL 2025

ATTACK:enterprise:S1118 → uses → ATTACK:enterprise:T1505.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3e7abaec-8d7a-4a81-be54-03492b6dc2b7

Mandiant Cutting Edge Part 2 January 2024

ATTACK:enterprise:G1030 → uses → ATTACK:enterprise:T1505.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4224f857-32f1-4288-959c-f4dca6a826dd

SentinelOne Agrius 2021

ATTACK:enterprise:S1110 → uses → ATTACK:enterprise:T1505.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4342d830-601b-45b7-9e0a-5ae7dfd5c964

Mandiant Pulse Secure Zero-Day April 2021

ATTACK:enterprise:S1119 → uses → ATTACK:enterprise:T1505.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--44cf5d7e-41dd-4bc4-b747-08d56ba489bb

Mandiant Cutting Edge Part 2 January 2024

ATTACK:enterprise:G0009 → uses → ATTACK:enterprise:T1505.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--44f230bb-b59a-4f30-8203-5e5ffd9796f5

CrowdStrike Deep Panda Web Shells

ATTACK:enterprise:C0017 → uses → ATTACK:enterprise:T1505.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4a6869c9-4261-44ca-83e0-b87e047af6b9

ATTACK:enterprise:C0034 → uses → ATTACK:enterprise:T1505.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4e1b8403-d2ed-4d24-b7cd-2974ef9ba1d3

Mandiant-Sandworm-Ukraine-2022

ATTACK:enterprise:C0041 → uses → ATTACK:enterprise:T1505.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4e7e832c-4066-4045-b180-8585d50adc0c

Dragos FROSTYGOOP 2024

ATTACK:enterprise:C0032 → uses → ATTACK:enterprise:T1505.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--55c21d63-7c56-4025-97dc-bb1bced3aa58

FireEye TRITON 2019

ATTACK:enterprise:C0064 → uses → ATTACK:enterprise:T1505.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5c7ac715-4d4c-4f02-9d84-4f99ef97f592

AI-Mexico-Govt-Breach

ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:T1505.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5fea62e7-67f8-4ff2-875d-a48393f99135

FireEye APT39 Jan 2019

ATTACK:enterprise:G0129 → uses → ATTACK:enterprise:T1505.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--60ac5ce0-46ef-4448-8d8d-f0efd7d9a691

Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023

ATTACK:enterprise:G0123 → uses → ATTACK:enterprise:T1505.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--60b2c702-e2f4-47fd-a009-3ba561bceeb8

CheckPoint Volatile Cedar March 2015 · ClearSky Lebanese Cedar Jan 2021

ATTACK:enterprise:G0093 → uses → ATTACK:enterprise:T1505.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--626697e3-0d05-4081-aa11-61280a502249

Cybereason Soft Cell June 2019 · Microsoft GALLIUM December 2019

ATTACK:enterprise:C0029 → uses → ATTACK:enterprise:T1505.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--63534b4f-e8aa-4824-99ce-0daf9d765b9d

Mandiant Cutting Edge January 2024 · Volexity Ivanti Zero-Day Exploitation January 2024

ATTACK:enterprise:S1112 → uses → ATTACK:enterprise:T1505.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--63d2756f-21af-420d-beaa-a334cb213e80

Mandiant Pulse Secure Zero-Day April 2021

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:T1505.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6468546f-721e-4df8-90a3-67b39a7b2834

Unit42 Emissary Panda May 2019

ATTACK:enterprise:C0040 → uses → ATTACK:enterprise:T1505.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--65570dc3-08cb-48b7-b99d-9c49ab293928

Google Cloud APT41 2024

ATTACK:enterprise:S0073 → uses → ATTACK:enterprise:T1505.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--660d09ce-8722-42b3-8503-911dff37bf22

ATTACK:enterprise:G0081 → uses → ATTACK:enterprise:T1505.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6a063d3a-cad2-4649-93a4-d1931ae6aaaf

TrendMicro Tropic Trooper May 2020

ATTACK:enterprise:G1003 → uses → ATTACK:enterprise:T1505.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6ecd9294-8818-4de9-a871-38d514380bd8

Cadet Blizzard emerges as novel threat actor · CISA GRU29155 2024

ATTACK:enterprise:G0125 → uses → ATTACK:enterprise:T1505.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--746c3746-a4e3-4fcb-849c-a1646e48a1bf

FireEye Exchange Zero Days March 2021 · Rapid7 HAFNIUM Mar 2021 · Volexity Exchange Marauder March 2021 · Microsoft Silk Typhoon MAR 2025 · Tarrask scheduled task · Microsoft HAFNIUM March 2020

ATTACK:enterprise:S1108 → uses → ATTACK:enterprise:T1505.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7d31e147-a32b-47f6-a39c-ef8b3c168ec5

Mandiant Pulse Secure Zero-Day April 2021

ATTACK:enterprise:S1189 → uses → ATTACK:enterprise:T1505.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7fd41982-17d3-4f09-812b-8024c3b5f500

Mandiant-Sandworm-Ukraine-2022 · GitHub Neo-reGeorg 2019

ATTACK:enterprise:S9014 → uses → ATTACK:enterprise:T1505.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8241e670-5d1a-4091-9ad0-99792d1dfe5b

Google UNC5221 Ivanti January 2025

ATTACK:enterprise:G1009 → uses → ATTACK:enterprise:T1505.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--880a83f9-a07a-436d-8aa4-1afbe8b66d57

Checkpoint MosesStaff Nov 2021

ATTACK:enterprise:G0034 → uses → ATTACK:enterprise:T1505.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8a7c712a-c79d-42f2-bfbf-d38798f4c855

ANSSI Sandworm January 2021

ATTACK:enterprise:S1120 → uses → ATTACK:enterprise:T1505.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8b39672f-a90d-49f4-9c01-9ebbd50d2c50

Mandiant Cutting Edge Part 2 January 2024

ATTACK:enterprise:S1113 → uses → ATTACK:enterprise:T1505.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--95373c46-d959-465a-9ac1-d1d5271805f2

Mandiant Pulse Secure Update May 2021

ATTACK:enterprise:G0117 → uses → ATTACK:enterprise:T1505.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--96772bc0-7a9e-4688-95a2-67fff1646be4

CISA AA20-259A Iran-Based Actor September 2020 · ClearSky Pay2Kitten December 2020

ATTACK:enterprise:G0131 → uses → ATTACK:enterprise:T1505.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9b6bebc2-caf5-4b22-847d-ef43881f9bd6

ESET Exchange Mar 2021

ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1505.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9ca80e08-f365-48c6-bb40-24657614b217

Secureworks BRONZE SILHOUETTE May 2023

ATTACK:enterprise:C0038 → uses → ATTACK:enterprise:T1505.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a75d7482-b44c-4fbf-88ab-17839c27a099

CISA Iran Albanian Attacks September 2022 · Microsoft Albanian Government Attacks September 2022

ATTACK:enterprise:S1188 → uses → ATTACK:enterprise:T1505.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--acf24e0b-9d44-4320-bfd3-3d9e4fc1a3c8

CCCS ArcaneDoor 2024

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1505.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ae7727c7-6b4a-48fb-8ecb-b07cbe819cad

CISA AA20-239A BeagleBoyz August 2020

ATTACK:enterprise:C0049 → uses → ATTACK:enterprise:T1505.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--af846746-077c-4696-b15a-1221914bf15b

CISA Leviathan 2024

ATTACK:enterprise:G0016 → uses → ATTACK:enterprise:T1505.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b1de5210-fbd9-4439-8d1a-bc400054d0ad

Mandiant APT29 Eye Spy Email Nov 22 · Cybersecurity Advisory SVR TTP May 2021

ATTACK:enterprise:C0012 → uses → ATTACK:enterprise:T1505.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b3fc9f8c-9074-42b8-a144-ad97aa017dce

Cybereason OperationCuckooBees May 2022

ATTACK:enterprise:T1505.003 → subtechnique-of → ATTACK:enterprise:T1505

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b5963cc5-0488-46a8-b47a-b781ac724590

ATTACK:enterprise:S0578 → uses → ATTACK:enterprise:T1505.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b847cd82-14c8-4270-b03d-2acf3abda4b6

Unit42 SUPERNOVA Dec 2020 · Guidepoint SUPERNOVA Dec 2020 · CISA Supernova Jan 2021

ATTACK:enterprise:S1163 → uses → ATTACK:enterprise:T1505.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b881b432-1b68-44f4-8a2c-f4eba99f2bb3

PWC Sea Turtle 2023

ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1505.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b8bb65e7-3846-4b41-8594-16409a94aa8d

DFIR Phosphorus November 2021 · DFIR Report APT35 ProxyShell March 2022

ATTACK:enterprise:G1043 → uses → ATTACK:enterprise:T1505.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--baaa98d7-25a4-47ae-9b60-dad129def3bf

Picus BlackByte 2022 · Microsoft BlackByte 2023

ATTACK:enterprise:S0185 → uses → ATTACK:enterprise:T1505.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bbe37d7e-ad35-4c74-a57c-9a398ef6b1be

FireEye APT34 Webinar Dec 2017

ATTACK:enterprise:S0020 → uses → ATTACK:enterprise:T1505.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bea7bd3c-1251-4858-8957-a6dc3bb840d2

ATTACK:enterprise:M1042 → mitigates → ATTACK:enterprise:T1505.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c077dd0a-7568-400b-9aad-e0535f356f71

ITSyndicate Disabling PHP functions

ATTACK:enterprise:M1018 → mitigates → ATTACK:enterprise:T1505.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c3b1f90e-6b04-4e6f-99ae-e63b1607f72c

NSA and ASD Detect and Prevent Web Shells 2020

ATTACK:enterprise:S1117 → uses → ATTACK:enterprise:T1505.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c3ff972a-2515-40a5-ac6d-e4e64f5df8f1

Volexity Ivanti Zero-Day Exploitation January 2024

ATTACK:enterprise:G1023 → uses → ATTACK:enterprise:T1505.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c45d16b1-9e15-4047-a0c9-4cb31d38ac48

Mandiant Pulse Secure Zero-Day April 2021 · Mandiant Pulse Secure Update May 2021

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1505.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c7017855-dc52-4e9d-977f-3af701e094c8

Volexity OceanLotus Nov 2017

ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1505.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cde53969-2e25-4424-b840-fe42806ee64e

Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024

ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:T1505.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d0cd2d2a-3a74-488b-8227-00e32ed12291

CISA Leviathan 2024 · CISA AA21-200A APT40 July 2021 · FireEye APT40 March 2019

ATTACK:enterprise:S1187 → uses → ATTACK:enterprise:T1505.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e1308e9f-b130-4979-88ca-dbdf36e3ba78

Mandiant APT29 Eye Spy Email Nov 22 · Cadet Blizzard emerges as novel threat actor

ATTACK:enterprise:G1041 → uses → ATTACK:enterprise:T1505.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e2e3eae7-879c-456c-a216-be6be395a582

Hunt Sea Turtle 2024 · PWC Sea Turtle 2023

ATTACK:enterprise:C0014 → uses → ATTACK:enterprise:T1505.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e49ceb1e-8ab0-44c5-8232-2b9aa0cf17ad

FoxIT Wocao December 2019

ATTACK:enterprise:C0039 → uses → ATTACK:enterprise:T1505.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f2348cdc-9379-44e2-909c-56e52d2079c9

Lumen Versa 2024

ATTACK:enterprise:G0094 → uses → ATTACK:enterprise:T1505.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f873875b-5be1-4a6d-81aa-d61a922df087

CISA AA20-301A Kimsuky

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.