Ten Character Webshell Attacker

ten_character_webshell_attacker is an intrusion actor observed in the mass exploitation of Microsoft Exchange Server vulnerabilities disclosed in 2021, including ProxyLogon-related flaws such as CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065. The actor’s distinguishing behavior includes uploading webshells to compromised Exchange servers, then using native Windows utilities to harden persistence and impede discovery by recursively changing webroot permissions to read-only and marking webshell files as hidden and system. This tradecraft indicates a focus on maintaining covert access after initial compromise while frustrating remediation and forensic review. The actor’s known activity is consistent with opportunistic post-exploitation following exploitation of public-facing applications. High-confidence behaviors include initial access via exploitation of internet-exposed Exchange services, persistence through webshell deployment, and defense evasion through file attribute manipulation and permission changes. The broader intrusion cluster associated with these Exchange exploitation waves commonly involved credential dumping, reconnaissance, ingress tool transfer, and data theft, but those behaviors cannot be attributed to this specific named actor at high confidence beyond the webshell-related actions explicitly observed. No reliable public attribution to a specific nation state, criminal organization, or established intrusion set is supported for this actor name. It appears to be a descriptive tracking label based on observed webshell tradecraft rather than a widely recognized threat group designation.