Loading malware…
Neo-reGeorg is an open-source web tunneling toolkit abused by threat actors to establish proxy access through compromised web servers and network appliances. Its server-side components tunnel SOCKS5 proxy traffic over HTTP or HTTPS, allowing operators to reach internal resources through ordinary web connections. Observed deployments include ASP.NET web shells on Microsoft Exchange servers, JSP and JSPX components in Oracle PeopleSoft environments, and installations on compromised VPN appliances.
Attackers use Neo-reGeorg after initial compromise to support internal reconnaissance, lateral movement, continued access, and traffic relay. It has also formed part of layered proxy infrastructure used for data exfiltration. Observed users include MirrorFace, also known as Earth Kasha; Shedding Zmiy; and ShinyHunters, tracked as UNC6240. ShinyHunters deployed it on compromised PeopleSoft hosts to pivot into internal networks. Shedding Zmiy also deployed a Neo-reGeorg web shell as an in-memory virtual ASP.NET resource through its BADSTATE framework. Components of Neo-reGeorg are incorporated into GhostContainer, an Exchange backdoor used by NightEagle. These uses reflect adoption of a publicly available toolkit rather than an exclusive association with any single actor.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
In the September campaign, attackers also used JSP web shells, the SIDEEYE backdoor, and Neo-reGeorg for tunneling.
Other infection pathways include exploitation of known security flaws in Citrix NetScaler ADC and NetScaler Gateway (CVE-2023-3519) and Commvault (CVE-2025-3928).
Other infection pathways include exploitation of known security flaws in Citrix NetScaler ADC and NetScaler Gateway (CVE-2023-3519) and Commvault (CVE-2025-3928).
12 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
In the September campaign, attackers also used JSP web shells, the SIDEEYE backdoor, and Neo-reGeorg for tunneling.
GhostContainer is assembled from several open-source components, including the Neo-reGeorg tunnel.
On some of the compromised Ivanti CSA appliances investigated, webshells related to the open-source tool Neo-reGeorg... were found.
MURKY PANDA has deployed web shells including Neo-reGeorg during their cyberespionage operations... MURKY PANDA heavily relies on exploiting internet-facing appliances to gain initial access and has frequently deployed web shells — including the Neo-reGeorg web shell frequently used by China-nexus adversaries — to establish persistence.
12 distinct techniques documented for this family, organized by ATT&CK tactic.
Godzilla ASPX, r57, suo5... several webshell and tunnel relays running Godzilla ASPX, suo5, r57, reGeorg, and Neo-reGeorg.
Инструменты для туннелирования злоумышленники хранили на GitHub, маскируя архивы и исполняемые файлы под легитимное ПО.
In the September campaign, they also used JSP web shells, the SIDEEYE backdoor, and Neo-ReGeorg for tunneling.
SIDEEYE provides reverse-proxy functionality, and the actor uploaded the Neo-reGeorg tunneling toolkit.
Multi-hop Proxy proxychains-ng across 80+ proxies.
Neo-reGeorg... [was deployed] using third-party compromised systems as reverse tunnels to proxy further malicious actions.
UNC6240 used 'u.jsp' to upload a valid digitally signed trojanized installer, 'Ple64.exe', and also uploaded the open-source Neo-reGeorg tunneling toolkit.
The group also used tunneling software to route internal traffic through ordinary web connections, enabling discovery and movement beyond the initial PeopleSoft host. Indicators identify tunnel.jsp and tunnel.jspx as Neo-reGeorg tunnels.
8 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
47 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A tunneling/proxy kit deployed to facilitate internal discovery and lateral movement from compromised PeopleSoft servers.
A tunneling tool used by the attackers for post-exploitation network access.
A web-shell-based tunneling and proxy tool used to route internal traffic over web connections, facilitating internal discovery and lateral movement following PeopleSoft compromise.
A web-shell-based tunneling/proxy tool used to route internal traffic through ordinary web connections, enabling network discovery and movement beyond the initially compromised PeopleSoft host.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.