Loading malware…
Glutton is a modular PHP backdoor framework targeting Linux-hosted PHP applications and PHP-FPM environments. It infects application files and operates within PHP processes, enabling remote command execution, file operations, PHP code execution, host-information collection, and retrieval of additional payloads. It can collect credentials and management data from Baota panels, inject malicious code into Baota, ThinkPHP, Yii, Laravel, and Dedecms installations, and deploy both PHP backdoors and an ELF backdoor commonly classified as a Winnti backdoor. Persistence has been implemented through modification of system startup configuration and continued infection of PHP application files. Observed victims include organizations in China and the United States in IT services, business operations, and social security sectors. The framework has also been found embedded in fraudulent or illicit business software distributed in cybercrime ecosystems. Its association with Winnti is assessed with moderate confidence. Glutton should not be conflated with the separately reported GLUTTON multi-platform webshell framework using PNG-based payload concealment.
4 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
3 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
GLUTTON : framework de webshells (JSP, ASPX, .NET, Node.js) avec transport stéganographique PNG, obfuscation Unicode/XML.
This investigation uncovered a previously undocumented advanced PHP backdoor, which we named Glutton due to its ability to infect large numbers of PHP files and implant l0ader_shell.
29 distinct techniques documented for this family, organized by ATT&CK tactic.
The Fengtai intrusion began through an Office Automation application that accepted uploaded ASPX files.
Distributing pre-compromised business systems with embedded l0ader_shell via cybercrime source code forums, enabling targeted attacks on the cybercrime ecosystem itself.
Supported Commands ... 151 shell
The response contains compressed PHP code, which is decompressed and executed.
To achieve persistence, it appends the following command to /etc/init.d/network
The php_modify task targets popular PHP frameworks such as ThinkPHP, Yii, Laravel, and Dedecms, injecting malicious code for further payload execution.
Attackers used server-side command pages to run Windows commands... [and] deployed PHP webshells masquerading as WordPress files.
do_modify Modifies critical BT panel files such as init.py, public.py, and userlogin.py, chieves objectives like: credential theft, token harvesting, exposing sensitive assets.
To achieve persistence, it appends the following command to /etc/init.d/network
All code execution occurs within PHP or PHP-FPM (FastCGI) processes, ensuring no file payloads are left behind, thus achieving a stealthy footprint.
confusion_d0c41072a0dc784c.jsp [is an] obfuscated JSP loader for PNG-carried in-memory payloads... downx.aspx [is an] arbitrary-file reader applying XOR with key 0xAA.
The webshell tooling itself, a custom framework the operators called GLUTTON, hid its payloads inside PNG image files using steganography.
The elf_install task downloads the Winnti backdoor, masquerading it as /lib/php-fpm.
All code execution occurs within PHP or PHP-FPM (FastCGI) processes, ensuring no file payloads are left behind, thus achieving a stealthy footprint.
Supported Commands ... 192 mkdir 193 write file 194 read file 195 create file 196 rm 197 copy file 198 rename file
A small decoder script on the server would read the image pixel by pixel, XOR-decrypt the hidden bytes using a fixed key, and load the resulting code directly into memory without ever writing an obviously malicious file to disk.
Supported Commands ... 199 chmod 200 chown
do_modify Modifies critical BT panel files such as init.py, public.py, and userlogin.py, chieves objectives like: credential theft, token harvesting, exposing sensitive assets.
The operator divided the LSASS dump into 37 blocks... and reconstructed the complete file.
The operator also collected the SAM and SYSTEM registry hives.
We speculate that the attackers use multiple methods to spread Glutton, including: Leveraging weak password brute-forcing techniques.
About HackBrowserData A legitimate tool designed to decrypt and export browser-stored data, including: Passwords, Browsing history, Cookies, etc.
do_modify Modifies critical BT panel files such as init.py, public.py, and userlogin.py, chieves objectives like: credential theft, token harvesting, exposing sensitive assets.
Data Exfiltration System information, such as OS versions and PHP versions.
Supported Commands ... 190 scandir 191 get dir info
find_all Collects sensitive information, compresses and uploads the data to the C2 server.
[The web shells were used for] querying internal databases... From there they pulled 822 OA user account records...
Supports both TCP and UDP, defaulting to UDP for communication.
Webshells used HTTP requests for command execution, SQL and file retrieval, while SecBox supported HTTP task routes including GET /task/{id}, POST /task, and POST /upload.
SecFlow designated authenticated SOCKS5 routes at 43.162.217.10:35888 and 103.45.65.93:35888; the operator retrieved LSASS dump blocks through an authenticated SOCKS route.
A Winnti backdoor process ( php-fpm ) listens on UDP port 6006. A PHP backdoor process ( [kworker/0:0HC] ) communicates over UDP.
The task_loader module plays a pivotal role in Glutton’s attack chain. Its primary function is to assess the execution environment and use different methods to download and execute the next-stage payload based on the detected environment.
find_all Collects sensitive information, compresses and uploads the data to the C2 server.
42 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.