Loading malware…
C99 is a PHP webshell used to remotely control compromised web servers through a browser-accessible interface. Widely used since the early and mid-2000s, it is a ready-made post-exploitation tool that enables attackers to execute commands and retain unauthorized access to vulnerable web applications. Multiple modified and derivative variants exist.
Deployment requires an attacker to place executable PHP code in a web-accessible location. C99 has been demonstrated in a Joomla compromise chain involving SQL injection, extraction and offline cracking of an administrator password, authentication to the administrative interface, and installation of a malicious component that enables subsequent webshell deployment. These preceding exploitation and credential-recovery steps are not intrinsic capabilities of C99.
Commands execute with the privileges available to the web server process; deployment alone does not imply root or administrator access. Its presence can provide continuing access after the original application vulnerability has been remediated, unless the webshell itself is also removed.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
"...upload webshells, such as variants of WSO, C99, or custom lightweight shells, into the webroot."
5 distinct techniques documented for this family, organized by ATT&CK tactic.
If the file upload feature is insecure, an attacker can upload a malicious script or executable to the server and then execute it, achieving RCE... Common scenarios include uploading a web shell.
If successful, the attacker can inject malicious PHP code or directly upload webshells, such as variants of WSO , C99 , or custom lightweight shells, into the webroot.
rule DarkSecurityTeam_Webshell { ... description = "Dark Security Team Webshell" ... }
Description C99 linux living off the land and privilege escalation. MITRE ATT&CK Techniques ... The following datasets were collected during this attack simulation: Sysmon_linux Path: /datasets/attack_techniques/T1548/c99/sysmon_linux.log
Relevant MITRE ATT&CK techniques include T1190 (Exploit Public-Facing Application), T1505.003 (Web Shell), and T1071.001 (Web Protocols for C2 communication).
36 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.