C99
C99 is a PHP web shell/backdoor shell. In the provided content it is referenced as an observed web shell uploaded into the webroot after successful exploitation of Adobe Magento CVE-2024-34102 ("SessionReaper"), alongside WSO and custom lightweight shells. Once deployed, such web shells provide persistent remote access and enable command execution; the same intrusion context also notes follow-on privilege escalation, creation of new administrative accounts, disabling of security plugins, lateral movement, and data theft after session compromise. C99 is also explicitly listed among known shell filenames and paths targeted by shell-finder reconnaissance tools, including examples such as "c99.php" and "/ALFA_DATA/alfacgiapi/c99.php", indicating it is a commonly recognized web shell name used by attackers and searched for on already-compromised websites. The content additionally contains a separate Splunk attack-simulation entry named "C99" describing Linux living-off-the-land and privilege-escalation test data, but that appears to be a detection dataset reference rather than evidence of a distinct malware family.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The SessionReaper vulnerability (CVE-2024-34102) arises from improper input validation and insecure session management within the Adobe Magento REST API. Specifically, the flaw allows an attacker to craft malicious API requests that manipulate session data stored on the server’s file system... | If successful, the attacker can inject malicious PHP code or directly upload webshells, such as variants of WSO, C99, or custom lightweight shells, into the webroot.
If successful, the attacker can inject malicious PHP code or directly upload webshells, such as variants of WSO, C99, or custom lightweight shells, into the webroot.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
"...upload webshells, such as variants of WSO, C99, or custom lightweight shells, into the webroot."
Techniques & procedures
4 distinct techniques documented for this family, organized by ATT&CK tactic.
Execution
1 techniqueIf successful, the attacker can inject malicious PHP code or directly upload webshells, such as variants of WSO , C99 , or custom lightweight shells, into the webroot.
Persistence
1 techniqueIf successful, the attacker can inject malicious PHP code or directly upload webshells, such as variants of WSO , C99 , or custom lightweight shells, into the webroot.
Privilege Escalation
1 techniqueDescription C99 linux living off the land and privilege escalation. MITRE ATT&CK Techniques ... The following datasets were collected during this attack simulation: Sysmon_linux Path: /datasets/attack_techniques/T1548/c99/sysmon_linux.log
Command and Control
1 techniqueRelevant MITRE ATT&CK techniques include T1190 (Exploit Public-Facing Application), T1505.003 (Web Shell), and T1071.001 (Web Protocols for C2 communication).
Recent activity
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A PHP web shell used to maintain persistent access, execute commands, and support post-exploitation activity on compromised servers.
A web shell/backdoor used on compromised websites for persistent unauthorized access.
Linux-focused activity or tooling discussed in the context of living-off-the-land and privilege escalation attack simulation data.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.