Loading malware…
Godzilla is a publicly available, Chinese-language web-shell framework developed by BeichenDream for red-team operations and widely abused to control compromised web servers. Observed implementations include JavaServer Pages web shells and ASP.NET variants operating on Windows and Linux servers. It provides remote command execution, file access and management, system-information collection, and dynamic loading of additional payloads or plugins.
Godzilla uses encrypted HTTP communications, commonly combining AES encryption with Base64 encoding. Java implementations decrypt supplied bytecode and load classes dynamically, while ASP.NET implementations can load and execute .NET assemblies in memory. Some variants retain the initial payload in a server-side session for subsequent requests. Java variants commonly frame encrypted responses with portions of an MD5-derived value. Memory-resident deployments integrate with application-server request handling through servlet filters, Tomcat valves, or ASP.NET request handlers, allowing operation without a separate web-shell file on disk. These in-memory implants can remain active until the hosting service restarts; disk-based deployments provide a separate means of maintaining access.
Attackers typically deploy Godzilla after exploiting internet-facing applications or abusing upload and deployment functionality. Documented targets include Atlassian Confluence, ManageEngine ADSelfService Plus and ServiceDesk Plus, JBoss and WildFly middleware, ConnectWise R1Soft Server Backup Manager, and Telerik-based ASP.NET applications. Godzilla has appeared in REF2924 activity and in campaigns involving advanced persistent threat actors targeting critical infrastructure, academic institutions, defense contractors, healthcare, finance, electronics, and IT consulting. It is frequently deployed alongside other implants and tunneling tools, including Cobalt Strike and suo5, to support continued post-exploitation activity. Credential dumping, privilege escalation, and network tunneling in these intrusions may be performed by companion tools rather than Godzilla itself.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
23 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
CVE-2026-82078 – An authenticated remote code execution vulnerability due to PaperCut NG / MF’s external user-lookup database connector, which allows an attacker with configuration access (via CVE-2026-81578) to load and execute Java bytecode via a crafted JDBC connection URL, achieving code execution. | After gaining code execution in one particular case, a threat actor dropped in-memory implants, including Godzilla C2 web shells and “suo5” HTTP proxy tunnels.
CVE-2026-81578 – An authentication bypass vulnerability due to PaperCut NG / MF’s use of the Apache Tapestry web framework, allowing an unauthenticated, external attacker to forge a URL that invokes sensitive administrative functionality (like ConfigEditor). | After gaining code execution in one particular case, a threat actor dropped in-memory implants, including Godzilla C2 web shells and “suo5” HTTP proxy tunnels.
An unauthenticated actor with network access to the web interface leveraged CVE-2022-22954 to execute an arbitrary shell command as a VMware user, then exploited CVE-2022-22960 to escalate privileges to root.
CVE-2021-44077, which Zoho rated critical, is an unauthenticated remote code execution (RCE) vulnerability affecting all ServiceDesk Plus versions up to, and including, version 11305.
The advisory details the active exploitation of an authentication bypass vulnerability (CVE-2021-40539) in Zoho ManageEngine ADSelfService Plus. Its update identifies tools APT actors are using to enable this campaign.
“8220 Gang ... is an attack group targeting vulnerable Windows and Linux-based servers using the CVE-2022-26134 vulnerability.” The article also states that “Hezb is a CoinMiner recently distributed through the CVE-2022-26134 vulnerability.”
The adversary exploited R1Soft Server Backup Manager through CVE-2022-36537 in its ZK Java Framework dependency, then uploaded a malicious JDBC driver containing Godzilla web shell code. Exploitation was observed on 29 November 2022, before public proof-of-concept exploits appeared on 9 December 2022.
We observed a new attack vector of weaponization for the vulnerability CVE-2023-22527 using the Godzilla backdoor. Following initial exploitation, a loader was loaded into the Atlassian victim server which loads a Godzilla webshell.
The report lists CVE-2011-4085 among the vulnerabilities highly likely exploited through JexBoss and describes it as a regression of CVE-2010-0738.
CVE-2015-7501 is identified as a deserialization vulnerability affecting Java environments using Apache Commons Collections, including JBoss-based environments, and as highly likely exploited through JexBoss.
The CSIRT considers it highly probable that JexBoss exploited CVE-2010-0738, an improper-access-control vulnerability affecting the exposed JBoss JMX console through version 5.1.x.
The report identifies CVE-2017-12149 as remote code execution via deserialization involving JMXInvokerServlet and records numerous HTTP GET and POST requests to /invoker/JMXInvokerServlet.
CVE-2019-18935 is a .NET deserialization vulnerability in RadAsyncUpload, a file upload feature; if exploited, a threat actor can perform remote code execution with the privileges of the w3wp.exe process on an IIS web server. | Ultimately, a Godzilla-style web shell was installed. The payload loads the embedded godmemshell.dll into memory and registers a malicious ASP.NET request handler.
Cisco Talos also identified attacks targeting three additional vulnerabilities within Cisco Catalyst SD-WAN Manager, tracked as CVE-2026-20133 (CVSS: 7.5), CVE-2026-20128 (CVSS: 7.5), and CVE-2026-20122 (CVSS: 5.4). All three vulnerabilities were disclosed along with security patches in February 2026. | These attacks were not attributed to UAT-8616; Cisco Talos identified a total of 10 clusters of threat actors leveraging the vulnerabilities within attacks, resulting in the deployment of webshell (Godzilla, Behinder, XenShell)...
Cisco Talos also identified attacks targeting three additional vulnerabilities within Cisco Catalyst SD-WAN Manager, tracked as CVE-2026-20133 (CVSS: 7.5), CVE-2026-20128 (CVSS: 7.5), and CVE-2026-20122 (CVSS: 5.4). All three vulnerabilities were disclosed along with security patches in February 2026. | These attacks were not attributed to UAT-8616; Cisco Talos identified a total of 10 clusters of threat actors leveraging the vulnerabilities within attacks, resulting in the deployment of webshell (Godzilla, Behinder, XenShell)...
Cisco Talos also identified attacks targeting three additional vulnerabilities within Cisco Catalyst SD-WAN Manager, tracked as CVE-2026-20133 (CVSS: 7.5), CVE-2026-20128 (CVSS: 7.5), and CVE-2026-20122 (CVSS: 5.4). All three vulnerabilities were disclosed along with security patches in February 2026. | These attacks were not attributed to UAT-8616; Cisco Talos identified a total of 10 clusters of threat actors leveraging the vulnerabilities within attacks, resulting in the deployment of webshell (Godzilla, Behinder, XenShell)...
Mandiant and Palo Alto’s Unit42 have also reported on Behinder and Godzilla web shells deployed upon initial access in high-profile intrusions such as SonicWall, and ProxyShell.
Threat actors abused a critical zero-day bug in a server that ran a KnowledgeDeliver LMS to install the Godzilla. The bug is a deserialization problem tracked as CVE-2026-5426 and can be abused without verification. It originates from the use of “shared hardcoded machine key in the web portal configuration.” | Threat actors abused a critical zero-day bug in a server that ran a KnowledgeDeliver LMS to install the Godzilla.
Once inside, the attackers deploy web shells such as GODZILLA to maintain persistent backdoor access and execute remote commands at will.
Once inside, the attackers deploy web shells such as GODZILLA to maintain persistent backdoor access and execute remote commands at will.
Once inside, the attackers deploy web shells such as GODZILLA to maintain persistent backdoor access and execute remote commands at will.
Once inside, the attackers deploy web shells such as GODZILLA to maintain persistent backdoor access and execute remote commands at will.
CVE-2026-20182 carries a CVSSv3.1 score of 10.0 (Critical) and is classified under CWE-287: Improper Authentication. The flaw affects the Cisco Catalyst SD-WAN Controller (formerly vSmart)... The peering authentication mechanism is not functioning correctly, allowing an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on the affected system.
11 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
They attempted to download web shells, including Godzilla, from likely compromised infrastructure associated with an agricultural-sector victim.
The Behinder-derived hard-coded key is also the default value when generating a shell template using the Behinder or derivative Godzilla webshell frameworks.
Their recent operations showcase advanced techniques, including the use of public-facing applications like IIS servers for initial access and the deployment of the Godzilla webshell for control.
The actor frequently, but not always, uses one or more intermediate downloader, such as an as yet unnamed PowerShell script, sLoad, Snatch, or Godzilla.
Operators scanned vulnerable ADSelfService Plus servers ... then delivered Godzilla web shells, the NGLite trojan, and the KdcSponge information stealer.
21 distinct techniques documented for this family, organized by ATT&CK tactic.
“PHANTOM PANDA leverages compromised third-party infrastructure in its operations.” The actor attempted to download web shells from infrastructure associated with an agricultural-sector victim and connect to systems associated with an automotive-sector victim to obtain tools.
app.jsp is a publicly available [T1588.001] webshell known as Godzilla.
The attack begins with the exploitation of CVE-2023-22527 using velocity.struts2.context to execute OGNL object.
A web shell provides an operator with a way to execute commands (input) and receive its results (output) on a target system.
The LNK file or document macros in turn download the next stage -- typically a PowerShell script which may download the final payload or another downloader such as sLoad.
Execution — Command and Scripting Interpreter: Unix Shell — T1059.004
On March 19, we detected a targeted email with a Microsoft Word attachment... that used an Xbagging (aka Bartallex) downloader macro.
Exploit Public-Facing Application Exchange vulnerability Struts2 S2-045 Java Deserialize vulnerability
It injects a custom valve into the Tomcat pipeline, which is intended to provide a backdoor or some form of unauthorized access.
This executable file serves as a dropper and contains an embedded, encoded Godzilla JAR file.
Elastic Security Labs observed the Microsoft .NET compiler (csc.exe) being used to compile a DLL file... Analysts who may have observed dynamic runtime compilation of .NET web shells should note that this was performed by the operator, not automatically by the system.
The second part of the JavaScript code has an object called data that contains Base64, which will be loaded as an anonymous class in-memory using sun.misc.Unsafe.
We found traces of the adversary dropping the malicious JDBC driver in {r1soft_install_location}/bin/mysql.jar on the R1Soft server.
Decodes the valveString from Base64 to a byte array.
It dynamically loads and defines a class from a Base64-encoded string.
LSASS Memory mimikatz... mimikatz paired with a Godzilla webshell.
The Godzilla-style web shell receives and executes .NET payloads through HTTP requests; the scanner also retrieves targets and communicates with Telegram over HTTP.
Godzilla webshell and suo5 SOCKS tunnel established.
TA1 exploited CVE 2022-22954 ... to download [T1105] a malicious shell script.
Godzilla is a sophisticated Chinese-language backdoor that uses AES encryption for communication and remains in-memory to avoid disk-based detection mechanisms.
Exfiltration — Exfiltration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted Non-C2 Protocol — T1048.001
91 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
75 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A memory-resident .NET web shell deployed into a Telerik-based ASP.NET process. It accepts encrypted HTTP requests, loads and retains .NET payloads in a cookie-based session, executes requested tasks, and returns encrypted results.
An ASP.NET web shell used for persistence and likely remote command execution on compromised web servers.
Web shell deployed after exploitation to provide persistent remote access to the compromised PaperCut server.
Feature-rich web shell providing encrypted command and control, file access, command execution, and plugin loading. In the observed PaperCut intrusion, attackers deployed it alongside suo5 as an in-memory Jetty servlet filter after chaining an authentication bypass and remote code execution vulnerability. The first deployment failed; a second attempt succeeded approximately an hour later. A separate operator then used the shell to collect host information, list directories, and read files. Its command channel used AES-128-ECB encryption and a custom HTTP header. The observed implant remained active until the PaperCut service restarted, without writing its payload to disk.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.