MalwareUsed by 1 actorExploits 4 CVEs

SIMPLESEESHARP

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

4 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

4 CVES

CVE-2021-26855ProxyLogon SSRF in Microsoft Exchange Server

The HAFNIUM threat group has been observed to use webshells including SIMPLESEESHARP, SPORTSBALL, ASPXSPY and China Chopper variants.

via mnemonic blogmnemonic.io

CVE-2021-26858Post-authentication Arbitrary File Write in Microsoft Exchange Server

The HAFNIUM threat group has been observed to use webshells including SIMPLESEESHARP, SPORTSBALL, ASPXSPY and China Chopper variants.

via mnemonic blogmnemonic.io

CVE-2021-26857Microsoft Exchange Unified Messaging Insecure Deserialization RCE

The HAFNIUM threat group has been observed to use webshells including SIMPLESEESHARP, SPORTSBALL, ASPXSPY and China Chopper variants.

via mnemonic blogmnemonic.io

CVE-2021-27065Microsoft Exchange Server ECP Arbitrary File Write

The HAFNIUM threat group has been observed to use webshells including SIMPLESEESHARP, SPORTSBALL, ASPXSPY and China Chopper variants.

via mnemonic blogmnemonic.io

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

HAFNIUM

The HAFNIUM threat group has been observed to use webshells including SIMPLESEESHARP, SPORTSBALL, ASPXSPY and China Chopper variants.

via mnemonic blogmnemonic.io

MITRE ATT&CK

Techniques & procedures

7 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

1 technique

T1588.002ToolEvidence1

The HAFNIUM threat group uses the following tools to help its post-compromise behaviors.

Execution

1 technique

T1059.003Windows Command ShellEvidence1

Web shells used by the HAFNIUM threat group, such as China Chopper, allow adversaries to execute commands on the victim server using Windows Command Shell (cmd.exe).

Persistence

1 technique

T1505.003Web ShellEvidence2

The HAFNIUM threat group has been observed to use webshells including SIMPLESEESHARP, SPORTSBALL, ASPXSPY and China Chopper variants.

Stealth

1 technique

T1036.005Match Legitimate Resource Name or LocationEvidence1

HAFNIUM masquerade names of deployed web shells as identical or similar names of legitimate files, such as log.aspx, logout.aspx, default.aspx, errorPage.aspx, and server.aspx.

Credential Access

1 technique

T1003.003NTDSEvidence1

HAFNIUM creates and steals copies of the NTDS.dit file using deployed web shells.

Discovery

1 technique

T1083File and Directory DiscoveryEvidence1

CVE-2021-26858 (CVSS 7.8) is a post-authentication arbitrary file write vulnerability in Exchange... they could then use this vulnerability to write a file to any path on the server.

Command and Control

1 technique

T1071.001Web ProtocolsEvidence1

The HAFNIUM threat group communicates with deployed web shells using application-layer web protocols (HTTP/HTTPS).

INDICATORS OF COMPROMISE

IOCs tracked for this family

8 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Hashes

8 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha256●●●●●●●●●●●●View more in app5 years ago

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

mnemonic blogNews

Jul 29, 2026

Threat Advisory: Multiple 0-day exploits targeting Microsoft Exchange | updated 15.03

A webshell used by HAFNIUM during exploitation of Microsoft Exchange vulnerabilities to maintain remote access on compromised servers.

picus security blogNews

Mar 10, 2021

Tactics, Techniques, and Procedures (TTPs) Used by HAFNIUM to Target Microsoft Exchange Servers

A simple ASPX web shell used post-compromise to write additional files to disk on compromised Exchange servers.

mitre attackNews

Jan 24, 2026

Server Software Component: Web Shell, Sub-technique T1505.003 - Enterprise | MITRE ATT&CK®

Web shell deployed on compromised servers as part of HAFNIUM intrusions.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching8

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities4

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping7

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareUsed by 1 actorExploits 4 CVEs

SIMPLESEESHARP

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

4 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

4 CVES

CVE-2021-26855ProxyLogon SSRF in Microsoft Exchange Server

The HAFNIUM threat group has been observed to use webshells including SIMPLESEESHARP, SPORTSBALL, ASPXSPY and China Chopper variants.

via mnemonic blogmnemonic.io

CVE-2021-26858Post-authentication Arbitrary File Write in Microsoft Exchange Server

The HAFNIUM threat group has been observed to use webshells including SIMPLESEESHARP, SPORTSBALL, ASPXSPY and China Chopper variants.

via mnemonic blogmnemonic.io

CVE-2021-26857Microsoft Exchange Unified Messaging Insecure Deserialization RCE

The HAFNIUM threat group has been observed to use webshells including SIMPLESEESHARP, SPORTSBALL, ASPXSPY and China Chopper variants.

via mnemonic blogmnemonic.io

CVE-2021-27065Microsoft Exchange Server ECP Arbitrary File Write

The HAFNIUM threat group has been observed to use webshells including SIMPLESEESHARP, SPORTSBALL, ASPXSPY and China Chopper variants.

via mnemonic blogmnemonic.io

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

HAFNIUM

The HAFNIUM threat group has been observed to use webshells including SIMPLESEESHARP, SPORTSBALL, ASPXSPY and China Chopper variants.

via mnemonic blogmnemonic.io

MITRE ATT&CK

Techniques & procedures

7 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

1 technique

T1588.002ToolEvidence1

The HAFNIUM threat group uses the following tools to help its post-compromise behaviors.

Execution

1 technique

T1059.003Windows Command ShellEvidence1

Web shells used by the HAFNIUM threat group, such as China Chopper, allow adversaries to execute commands on the victim server using Windows Command Shell (cmd.exe).

Persistence

1 technique

T1505.003Web ShellEvidence2

The HAFNIUM threat group has been observed to use webshells including SIMPLESEESHARP, SPORTSBALL, ASPXSPY and China Chopper variants.

Stealth

1 technique

T1036.005Match Legitimate Resource Name or LocationEvidence1

HAFNIUM masquerade names of deployed web shells as identical or similar names of legitimate files, such as log.aspx, logout.aspx, default.aspx, errorPage.aspx, and server.aspx.

Credential Access

1 technique

T1003.003NTDSEvidence1

HAFNIUM creates and steals copies of the NTDS.dit file using deployed web shells.

Discovery

1 technique

T1083File and Directory DiscoveryEvidence1

CVE-2021-26858 (CVSS 7.8) is a post-authentication arbitrary file write vulnerability in Exchange... they could then use this vulnerability to write a file to any path on the server.

Command and Control

1 technique

T1071.001Web ProtocolsEvidence1

The HAFNIUM threat group communicates with deployed web shells using application-layer web protocols (HTTP/HTTPS).

INDICATORS OF COMPROMISE

IOCs tracked for this family

8 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Hashes

8 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha256●●●●●●●●●●●●View more in app5 years ago

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

mnemonic blogNews

Jul 29, 2026

Threat Advisory: Multiple 0-day exploits targeting Microsoft Exchange | updated 15.03

A webshell used by HAFNIUM during exploitation of Microsoft Exchange vulnerabilities to maintain remote access on compromised servers.

picus security blogNews

Mar 10, 2021

Tactics, Techniques, and Procedures (TTPs) Used by HAFNIUM to Target Microsoft Exchange Servers

A simple ASPX web shell used post-compromise to write additional files to disk on compromised Exchange servers.

mitre attackNews

Jan 24, 2026

Server Software Component: Web Shell, Sub-technique T1505.003 - Enterprise | MITRE ATT&CK®

Web shell deployed on compromised servers as part of HAFNIUM intrusions.

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching8

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities4

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping7

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.