China Chopper

Malicious cyber actors are increasingly targeting unpatched Virtual Private Network vulnerabilities. An arbitrary code execution vulnerability in Citrix VPN appliances, known as CVE-2019-19781, has been detected in exploits in the wild. An arbitrary file reading vulnerability in Pulse Secure VPN servers, known as CVE-2019-11510, continues to be an attractive target for malicious actors. | Of the top 10, the second-most-reported vulnerable technology was a widespread Web framework known as Apache Struts... CVE-2019-0604 Vulnerable Products: Microsoft SharePoint... CVE-2018-7600 Vulnerable Products: Drupal... CVE-2019-19781 Vulnerable Products: Citrix Application Delivery Controller, Citrix Gateway, and Citrix SDWAN WANOP | An arbitrary code execution vulnerability in Citrix VPN appliances, known as CVE-2019-19781, has been detected in exploits in the wild. An arbitrary file reading vulnerability in Pulse Secure VPN servers, known as CVE-2019-11510, continues to be an attractive target for malicious actors. | CVE-2017-5638 Vulnerable Products: Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 Associated Malware: JexBoss ... CVE-2019-0604 Vulnerable Products: Microsoft SharePoint Associated Malware: China Chopper ... CVE-2018-7600 Vulnerable Products: Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 Associated Malware: Kitty

"...attacker launching an exploit to achieve remote code execution..."

During the 2016 Ukraine Electric Power Attack, Sandworm Team used the xp_cmdshell command in MS-SQL. During the 2025 Poland Wiper Attacks, the adversaries leveraged PsExec to run cmd.exe commands on multiple victim machines. Numerous malware families and groups are described as using cmd.exe, cmd /c, Windows command shell, or command-line interfaces to execute commands, payloads, reconnaissance, persistence, cleanup, and ransomware actions.

U.S. Government reporting has identified the top 10 most exploited vulnerabilities by state, nonstate, and unattributed cyber actors from 2016 to 2019 as follows: CVE-2017-11882, CVE-2017-0199, CVE-2017-5638, CVE-2012-0158, CVE-2019-0604, CVE-2017-0143, CVE-2018-4878, CVE-2017-8759, CVE-2015-1641, and CVE-2018-7600.

Customers running the latest definitions are protected by the following IPS signatures: China.Chopper.Web.Shell.Client.Connection

"Sandworm Team used UPX to pack a copy of Mimikatz"; "APT38 has used several code packing methods such as Themida, Enigma, VMProtect, and Obsidium"; "Lazarus Group packed malicious .db files with Themida to evade detection."

"...and altered access logs to evade detection."

Once the attackers gained access to the network, they deleted the .aspx webshell file to cover their tracks

APT28 has performed timestomping on victim files. APT29 has used timestomping to alter the Standard Information timestamps on their web shells to match other files in the same directory. APT32 has used scheduled task raw XML with a backdated timestamp... APT38 has modified data timestamps to mimic files that are in the same folder on a compromised host.

China Chopper ... Brute Force: Password Guessing

adding attack.discovery since rule already have tags t1018, t1033 & t1087.

The content repeatedly describes threat actors and malware performing network scanning, port scanning, service enumeration, OS fingerprinting, and identifying open ports/services across victim environments.

Administrators should search for aspx files in the following paths... any .aspx file under this folder or sub folders... any file or modified file that is not part of a standard install

Adding attack.discovery since rule already have t1082, t1087 and t1046

APT28 has staged archives of collected data on a target's Outlook Web Access (OWA) server.

BRONZE UNION appears to use a combination of self-registered IP addresses and commercial VPN services in its command and control (C2) and operational infrastructure. The threat actors also integrate infrastructure they likely previously compromised for espionage purposes.

The content repeatedly describes threat actors, malware, and campaigns using HTTP and/or HTTPS for command and control, including examples such as BlackEnergy communicating with C2 over HTTP POST requests and many other families using HTTP/S for C2.

Webshells are utilized for the following purposes: To use as a relay point to issue commands to hosts inside the network without direct internet access;

Webshells are utilized for the following purposes: To upload additional malware for the potential of creating, for example, a watering hole for infection and scanning of further victims;

Many entries state malware or actors can upload, transfer, send, or exfiltrate files from compromised hosts to command-and-control servers or attacker infrastructure.

The TMP files were then staged for exfiltration on Internet-facing servers that had previously been compromised with the China Chopper web shell. From those servers the threat actor could use a web shell to retrieve the encrypted archives.