DEWMODE
DEWMODE is a PHP web shell used by TA505, also associated in the provided reporting with the CL0P ransomware operation. It was deployed during zero-day exploitation campaigns against internet-facing Accellion File Transfer Appliance (FTA) servers from late 2020 to early 2021. The malware is specifically designed to target Accellion FTA devices and interact with the underlying MySQL database to steal data. The reporting places DEWMODE within TA505/CL0P’s broader malware toolkit alongside FlawedGrace, SDBot, Truebot, Cobalt Strike, and LEMURLOOT. High-confidence context indicates its use in mass exploitation of file transfer platforms for data theft and extortion-oriented operations. The content does not provide specific DEWMODE file hashes, domains, or other unique indicators of compromise.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
In a campaign from 2020 to 2021, TA505 used several zero-day exploits to install a web shell named DEWMODE on internet-facing Accellion FTA servers.
From late 2020 to early 2021, threat actors exploited multiple zero-day vulnerabilities in Accellion's legacy File Transfer Appliance (FTA) to install the DEWMODE web shell.
Techniques & procedures
3 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 techniqueCL0P ransomware group exploited the zero-day vulnerability CVE-2023-34362 affecting MOVEit Transfer software; begins with a SQL injection to infiltrate the MOVEit Transfer web application.
Persistence
1 techniqueIn May 2023, the CL0P ransomware group exploited a SQL injection zero-day vulnerability CVE-2023-34362 to install a web shell named LEMURLOOT on MOVEit Transfer web applications [T1190].
Exfiltration
1 techniqueCL0P actors exfiltrate data for C2 channels.
Recent activity
2 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.
No news coverage yet. Advisories and community discussion only.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.