MalwareUsed by 1 actorExploits 4 CVEs

SIMPLESEESHARP

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

4 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

4 CVES

CVE-2021-26855ProxyLogon Pre-auth SSRF in Microsoft Exchange Server

SIMPLESEESHARP is a simple ASPX web shell used by the HAFNIUM to write additional files to disk, such as the SPORTSBALL web shell [3].

via picus security blogpicussecurity.com

CVE-2021-27065Post-auth arbitrary file write in Microsoft Exchange Server ECP (ProxyLogon chain)

SIMPLESEESHARP is a simple ASPX web shell used by the HAFNIUM to write additional files to disk, such as the SPORTSBALL web shell [3].

via picus security blogpicussecurity.com

CVE-2021-26858Arbitrary File Write in Microsoft Exchange Server

SIMPLESEESHARP is a simple ASPX web shell used by the HAFNIUM to write additional files to disk, such as the SPORTSBALL web shell [3].

via picus security blogpicussecurity.com

CVE-2021-26857Microsoft Exchange Server UMWorkerProcess insecure deserialization RCE

SIMPLESEESHARP is a simple ASPX web shell used by the HAFNIUM to write additional files to disk, such as the SPORTSBALL web shell [3].

via picus security blogpicussecurity.com

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

HAFNIUM

SIMPLESEESHARP is a simple ASPX web shell used by the HAFNIUM to write additional files to disk, such as the SPORTSBALL web shell [3].

via picus security blogpicussecurity.com

MITRE ATT&CK

Techniques & procedures

6 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

1 technique

T1588.002ToolEvidence1

The HAFNIUM threat group uses the following tools to help its post-compromise behaviors.

Execution

1 technique

T1059.003Windows Command ShellEvidence1

Web shells used by the HAFNIUM threat group, such as China Chopper, allow adversaries to execute commands on the victim server using Windows Command Shell (cmd.exe).

Persistence

1 technique

T1505.003Web ShellEvidence1

Adversaries use web shells, web scripts placed on web servers, as backdoors to establish persistency on the target server. HAFNIUM utilize the following web shells... SIMPLESEESHARP, SPORTSBALL, China Chopper, ASPXSPY.

Stealth

1 technique

T1036.005Match Legitimate Resource Name or LocationEvidence1

HAFNIUM masquerade names of deployed web shells as identical or similar names of legitimate files, such as log.aspx, logout.aspx, default.aspx, errorPage.aspx, and server.aspx.

Credential Access

1 technique

T1003.003NTDSEvidence1

HAFNIUM creates and steals copies of the NTDS.dit file using deployed web shells.

Command and Control

1 technique

T1071.001Web ProtocolsEvidence1

The HAFNIUM threat group communicates with deployed web shells using application-layer web protocols (HTTP/HTTPS).

INDICATORS OF COMPROMISE

IOCs tracked for this family

8 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Hashes

8 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha256●●●●●●●●●●●●View more in app5 years ago

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

picus security blogNews

Mar 10, 2021

Tactics, Techniques, and Procedures (TTPs) Used by HAFNIUM to Target Microsoft Exchange Servers

A simple ASPX web shell used post-compromise to write additional files to disk on compromised Exchange servers.

mitre attackNews

Jan 24, 2026

Server Software Component: Web Shell, Sub-technique T1505.003 - Enterprise | MITRE ATT&CK®

Web shell deployed on compromised servers as part of HAFNIUM intrusions.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching8

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities4

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping6

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareUsed by 1 actorExploits 4 CVEs

SIMPLESEESHARP

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

4 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

4 CVES

CVE-2021-26855ProxyLogon Pre-auth SSRF in Microsoft Exchange Server

SIMPLESEESHARP is a simple ASPX web shell used by the HAFNIUM to write additional files to disk, such as the SPORTSBALL web shell [3].

via picus security blogpicussecurity.com

CVE-2021-27065Post-auth arbitrary file write in Microsoft Exchange Server ECP (ProxyLogon chain)

SIMPLESEESHARP is a simple ASPX web shell used by the HAFNIUM to write additional files to disk, such as the SPORTSBALL web shell [3].

via picus security blogpicussecurity.com

CVE-2021-26858Arbitrary File Write in Microsoft Exchange Server

SIMPLESEESHARP is a simple ASPX web shell used by the HAFNIUM to write additional files to disk, such as the SPORTSBALL web shell [3].

via picus security blogpicussecurity.com

CVE-2021-26857Microsoft Exchange Server UMWorkerProcess insecure deserialization RCE

SIMPLESEESHARP is a simple ASPX web shell used by the HAFNIUM to write additional files to disk, such as the SPORTSBALL web shell [3].

via picus security blogpicussecurity.com

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

HAFNIUM

SIMPLESEESHARP is a simple ASPX web shell used by the HAFNIUM to write additional files to disk, such as the SPORTSBALL web shell [3].

via picus security blogpicussecurity.com

MITRE ATT&CK

Techniques & procedures

6 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

1 technique

T1588.002ToolEvidence1

The HAFNIUM threat group uses the following tools to help its post-compromise behaviors.

Execution

1 technique

T1059.003Windows Command ShellEvidence1

Web shells used by the HAFNIUM threat group, such as China Chopper, allow adversaries to execute commands on the victim server using Windows Command Shell (cmd.exe).

Persistence

1 technique

T1505.003Web ShellEvidence1

Stealth

1 technique

T1036.005Match Legitimate Resource Name or LocationEvidence1

HAFNIUM masquerade names of deployed web shells as identical or similar names of legitimate files, such as log.aspx, logout.aspx, default.aspx, errorPage.aspx, and server.aspx.

Credential Access

1 technique

T1003.003NTDSEvidence1

HAFNIUM creates and steals copies of the NTDS.dit file using deployed web shells.

Command and Control

1 technique

T1071.001Web ProtocolsEvidence1

The HAFNIUM threat group communicates with deployed web shells using application-layer web protocols (HTTP/HTTPS).

INDICATORS OF COMPROMISE

IOCs tracked for this family

8 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Hashes

8 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha256●●●●●●●●●●●●View more in app5 years ago

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

picus security blogNews

Mar 10, 2021

Tactics, Techniques, and Procedures (TTPs) Used by HAFNIUM to Target Microsoft Exchange Servers

A simple ASPX web shell used post-compromise to write additional files to disk on compromised Exchange servers.

mitre attackNews

Jan 24, 2026

Server Software Component: Web Shell, Sub-technique T1505.003 - Enterprise | MITRE ATT&CK®

Web shell deployed on compromised servers as part of HAFNIUM intrusions.

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching8

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities4

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping6

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.