Skip to main content
Mallory
MalwareUsed by 1 actorExploits 2 CVEs

C99

C99 is a PHP web shell/backdoor shell. In the provided content it is referenced as an observed web shell uploaded into the webroot after successful exploitation of Adobe Magento CVE-2024-34102 ("SessionReaper"), alongside WSO and custom lightweight shells. Once deployed, such web shells provide persistent remote access and enable command execution; the same intrusion context also notes follow-on privilege escalation, creation of new administrative accounts, disabling of security plugins, lateral movement, and data theft after session compromise. C99 is also explicitly listed among known shell filenames and paths targeted by shell-finder reconnaissance tools, including examples such as "c99.php" and "/ALFA_DATA/alfacgiapi/c99.php", indicating it is a commonly recognized web shell name used by attackers and searched for on already-compromised websites. The content additionally contains a separate Splunk attack-simulation entry named "C99" describing Linux living-off-the-land and privilege-escalation test data, but that appears to be a detection dataset reference rather than evidence of a distinct malware family.

Share:
For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

EXPLOITED CVES

Vulnerabilities exploited

2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

2 CVES
CVE-2024-34102CosmicStingExploited in the wild

The SessionReaper vulnerability (CVE-2024-34102) arises from improper input validation and insecure session management within the Adobe Magento REST API. Specifically, the flaw allows an attacker to craft malicious API requests that manipulate session data stored on the server’s file system... | If successful, the attacker can inject malicious PHP code or directly upload webshells, such as variants of WSO, C99, or custom lightweight shells, into the webroot.

via rescana blogrescana.com
CVE-2025-54236SessionReaper in Adobe Commerce / Magento Open Source

If successful, the attacker can inject malicious PHP code or directly upload webshells, such as variants of WSO, C99, or custom lightweight shells, into the webroot.

via rescana blogrescana.com
THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details
MageCart

"...upload webshells, such as variants of WSO, C99, or custom lightweight shells, into the webroot."

via rescana blogrescana.com
MITRE ATT&CK

Techniques & procedures

4 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

1 technique
T1059.006PythonEvidence1
TacticExecution

If successful, the attacker can inject malicious PHP code or directly upload webshells, such as variants of WSO , C99 , or custom lightweight shells, into the webroot.

Persistence

1 technique
T1505.003Web ShellEvidence1

If successful, the attacker can inject malicious PHP code or directly upload webshells, such as variants of WSO , C99 , or custom lightweight shells, into the webroot.

T1548Abuse Elevation Control MechanismEvidence1

Description C99 linux living off the land and privilege escalation. MITRE ATT&CK Techniques ... The following datasets were collected during this attack simulation: Sysmon_linux Path: /datasets/attack_techniques/T1548/c99/sysmon_linux.log

T1071.001Web ProtocolsEvidence1

Relevant MITRE ATT&CK techniques include T1190 (Exploit Public-Facing Application), T1505.003 (Web Shell), and T1071.001 (Web Protocols for C2 communication).

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.
IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities2

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping4

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.