MalwareUsed by 1 actorExploits 1 CVE

RelayShell

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

1 CVES

CVE-2025-49113Authenticated RCE in Roundcube Webmail upload handlerExploited in the wild

Lazarus also used CVE-2025-49113 to exploit vulnerable Roundcube webmail servers. The compromised servers were infected with RelayShell, a PHP webshell that repurposes compromised web servers as relay nodes within the attacker’s command-and-control infrastructure. | The compromised servers were infected with RelayShell, a PHP webshell that repurposes compromised web servers as relay nodes within the attacker’s command-and-control infrastructure.

via checkpoint research blogresearch.checkpoint.com

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Lazarus

The compromised servers were infected with RelayShell, a PHP webshell that repurposes compromised web servers as relay nodes within the attacker’s command-and-control infrastructure.

via checkpoint research blogresearch.checkpoint.com

MITRE ATT&CK

Techniques & procedures

6 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1078Valid AccountsEvidence1

Exploitation of this vulnerability requires authentication with valid Roundcube credentials... We assess that the threat actor likely leveraged these credentials to authenticate to the affected Roundcube instances

T1190Exploit Public-Facing ApplicationEvidence2

Lazarus also used CVE-2025-49113 to exploit vulnerable Roundcube webmail servers.

Persistence

2 techniques

T1078Valid AccountsEvidence1

T1505.003Web ShellEvidence2

The compromised servers were infected with RelayShell, a PHP webshell that repurposes compromised web servers as relay nodes within the attacker’s command-and-control infrastructure.

Privilege Escalation

1 technique

T1078Valid AccountsEvidence1

Stealth

1 technique

T1078Valid AccountsEvidence1

Command and Control

2 techniques

T1071Application Layer ProtocolEvidence2

At startup, the implant iterates through the configured servers in order, parsing each URL into its host and path components, establishing an HTTP connection

T1090ProxyEvidence2

RelayShell ... repurposes compromised web servers as relay nodes within the attacker’s command-and-control infrastructure.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

Command results are returned through the send channel in a compact JSON envelope

INDICATORS OF COMPROMISE

IOCs tracked for this family

2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Hashes

2 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha256●●●●●●●●●●●●View more in apptoday

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

malware newsNews

Aug 11, 2026

Shattering the Dream - When a Job Offer Becomes a Zero-Day Attack - Malware News - Malware Analysis, News and Indicators

A previously undocumented PHP webshell that primarily acts as a relay between operators and infected endpoints using victim and operator modes plus a file-based messaging channel on compromised servers.

checkpoint research blogNews

Aug 11, 2026

Shattering the Dream - When a Job Offer Becomes a Zero-Day Attack - Check Point Research

A previously undocumented PHP webshell used as a relay layer rather than a classic command shell. It establishes victim and operator sessions, uses file-based messaging channels, and turns compromised Roundcube, WordPress, or PrestaShop servers into C2 relay nodes.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching2

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities1

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping6

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareUsed by 1 actorExploits 1 CVE

RelayShell

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

1 CVES

CVE-2025-49113Authenticated RCE in Roundcube Webmail upload handlerExploited in the wild

via checkpoint research blogresearch.checkpoint.com

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Lazarus

The compromised servers were infected with RelayShell, a PHP webshell that repurposes compromised web servers as relay nodes within the attacker’s command-and-control infrastructure.

via checkpoint research blogresearch.checkpoint.com

MITRE ATT&CK

Techniques & procedures

6 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1078Valid AccountsEvidence1

T1190Exploit Public-Facing ApplicationEvidence2

Lazarus also used CVE-2025-49113 to exploit vulnerable Roundcube webmail servers.

Persistence

2 techniques

T1078Valid AccountsEvidence1

T1505.003Web ShellEvidence2

The compromised servers were infected with RelayShell, a PHP webshell that repurposes compromised web servers as relay nodes within the attacker’s command-and-control infrastructure.

Privilege Escalation

1 technique

T1078Valid AccountsEvidence1

Stealth

1 technique

T1078Valid AccountsEvidence1

Command and Control

2 techniques

T1071Application Layer ProtocolEvidence2

At startup, the implant iterates through the configured servers in order, parsing each URL into its host and path components, establishing an HTTP connection

T1090ProxyEvidence2

RelayShell ... repurposes compromised web servers as relay nodes within the attacker’s command-and-control infrastructure.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

Command results are returned through the send channel in a compact JSON envelope

INDICATORS OF COMPROMISE

IOCs tracked for this family

2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Hashes

2 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha256●●●●●●●●●●●●View more in apptoday

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

malware newsNews

Aug 11, 2026

Shattering the Dream - When a Job Offer Becomes a Zero-Day Attack - Malware News - Malware Analysis, News and Indicators

checkpoint research blogNews

Aug 11, 2026

Shattering the Dream - When a Job Offer Becomes a Zero-Day Attack - Check Point Research

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching2

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities1

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping6

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.