Six Character Webshell Attacker

six_character_webshell_attacker is an uncategorized intrusion actor observed during the mass exploitation of Microsoft Exchange Server vulnerabilities disclosed in 2021, including ProxyLogon-related flaws such as CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065. The actor was seen uploading webshells to compromised Exchange servers and copying them to additional locations within the webroot, indicating efforts to preserve access and improve operational resilience after initial compromise. Activity associated with this intrusion cluster fits a broader pattern of Exchange exploitation in which attackers obtained remote code execution and elevated privileges on internet-facing mail servers, then used webshell-based access for follow-on operations. High-confidence behaviors supported here include initial access through exploitation of public-facing applications, persistence through webshell deployment and duplication, and post-exploitation actions consistent with hands-on-keyboard server abuse. The available evidence does not support a reliable attribution to a named nation-state or criminal group, nor does it establish a distinct malware family beyond generic webshell usage. This actor should be understood as a practical post-exploitation operator leveraging exposed Exchange infrastructure for durable access rather than as a fully attributed threat group with a well-established alias set. No high-confidence evidence here supports ransomware deployment, extortion operations, or a specific geographic origin.