BEHINDER
Behinder is a publicly available web shell, commonly referenced as a JSP web shell, that provides remote backdoor access to compromised servers and allows operators to execute commands on those systems. Reporting in the provided content shows it being deployed after exploitation of internet-facing applications, including Atlassian Confluence and Cisco Catalyst SD-WAN Manager/Controller environments, and used for persistent access alongside other web shells such as Godzilla, neo-reGeorg, China Chopper, AntSword, and XenShell. In one Cisco Talos-tracked cluster active since at least March 10, 2026, a modified Behinder variant was deployed as "conf.jsp" and used Base64 encoding instead of the AES encryption commonly seen in other variants; another cluster deployed a Behinder variant as "sysinit.jsp." In Volexity’s analysis of CVE-2022-26134 exploitation against Confluence, attackers installed BEHINDER on compromised servers, then used it to deploy China Chopper and a file-upload tool, dump Confluence user tables, write additional web shells, and alter access logs. The content also associates Behinder with multiple China-nexus or Asia-based intrusion sets and campaigns, including APT15, UNC5174/Houken, and TGR-STA-1030/UNC6619, as well as broader activity assessed as aligned with Chinese tooling and operator working hours. Observed targets and victim sectors in campaigns where Behinder was used include government, critical infrastructure, telecommunications, media, finance, transport, education, and foreign affairs organizations. Detection names mentioned in the content include FireEye signatures such as FE_Webshell_JSP_BEHINDER_1, Webshell.JSP.BEHINDER, and Webshell.JSP.BEHINDER.MVX. Specific infrastructure and filenames directly tied to observed Behinder deployments in the content include 71.80.85[.]135 with conf.jsp and 212.83.162[.]37 with sysinit.jsp.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
7 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Following their exploitation, the threat actor deployed a variant of the Behinder webshell under the filename “conf.jsp”.
Following their exploitation, the threat actor deployed a variant of the Behinder webshell under the filename “conf.jsp”.
Following their exploitation, the threat actor deployed a variant of the Behinder webshell under the filename “conf.jsp”.
In the breach analyzed by Volexity, threat actors installed BEHINDER, a JSP web shell that allows threat actors to execute commands on the compromised server remotely.
Mandiant disclosed the vulnerability CVE-2021-20023 to SonicWall PSIRT on April 6, 2021... a patch became available April 19. To mitigate the three CVEs, Mandiant and SonicWall recommend upgrading Email Security to version 10.0.9.6173 (Windows) or 10.0.9.6177 (Hardware & ESXi Virtual Appliances).
Mandiant disclosed the vulnerabilities CVE-2021-20021 and CVE-2021-20022 to SonicWall PSIRT on March 26, 2021... a hotfix became available on April 9, 2021... To mitigate the three CVEs, Mandiant and SonicWall recommend upgrading Email Security to version 10.0.9.6173 (Windows) or 10.0.9.6177 (Hardware & ESXi Virtual Appliances).
SonicWall has deployed Intrusion Prevention System (IPS) signatures... IPS Signature : 15520 WEB-ATTACKS SonicWall Email Security (CVE-2021-20022 Vulnerability) ... Mandiant disclosed the vulnerabilities CVE-2021-20021 and CVE-2021-20022... a hotfix became available on April 9, 2021.
Groups observed using it
5 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Use of Chinese-documented tooling (e.g., Behinder, VShell), and operational activity aligned with China Standard Time (UTC+8).
Web shells – AntSword, Behinder, China Chopper, Godzilla , giving the hackers backdoor access to the breached systems.
"...includes webshells such as Behinder, Godzilla, and Neo-reGeorg..."
FireEye Malware File Scanning ... FE_Webshell_JSP_BEHINDER_1 ... Webshell.JSP.BEHINDER ... Webshell.JSP.BEHINDER.MVX
Techniques & procedures
7 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 techniqueThese clusters have been exploiting the CVE-2026-20133, CVE-2026-20128, and CVE-2026-20122 chain since early March 2026, following the publication of proof-of-concept code by ZeroZenX Labs.
Execution
2 techniquesThe tools deployed by these clusters range from webshells (Godzilla, Behinder, XenShell) and red team frameworks (AdaptixC2, Sliver) to cryptocurrency miners (XMRig) and credential stealers targeting admin hashes, JWT tokens and AWS credentials.
The activity has been found to leverage publicly available proof-of-concept exploit code to deploy web shells on hacked systems, allowing the operators to run arbitrary bash commands.
Persistence
1 techniqueAfter successfully opening a connection to the portal server, the actor tries to install Cobalt Strike and webshells on that server.
Stealth
1 techniqueLateral Movement
1 techniqueTalos is also aware of the widespread in-the-wild active exploitation of three vulnerabilities in unpatched Cisco Catalyst SD-WAN Manager infrastructure (CVE-2026-20133, CVE-2026-20128, and CVE-2026-20122) that, when chained together, can allow a remote unauthenticated attacker to gain access to the device.
Collection
1 technique"...the threat actors dumped the user tables of the Confluence server..."
IOCs tracked for this family
2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
Recent activity
14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A web shell deployed by multiple clusters on hacked Cisco SD-WAN systems.
A webshell used by threat clusters after exploiting Cisco SD-WAN vulnerabilities.
A JSP webshell used after exploitation of Cisco SD-WAN vulnerabilities; one observed variant was modified to use only Base64 encoding instead of the AES encryption commonly seen in other variants.
Post-exploitation tool/webshell referenced as commonly used by China-nexus intrusion activity.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.