MalwareUsed by 1 actorExploits 1 CVE

Mushr00w_upl.php

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

1 CVES

CVE-2026-14894Unauthenticated Arbitrary File Upload in Super FormsExploited in the wild

A critical Super Forms – Drag & Drop Form Builder flaw (CVSS 9.8) lacks file-type validation, allowing unauthenticated attackers to upload arbitrary files, including executable PHP files, resulting in remote code execution.

via mkd cirtmkd-cirt.mk

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Mushr00w

Le payload observé est un webshell PHP nommé Mushr00w_upl.php, utilisé comme dropper de premier niveau pour déposer d’autres malwares, kits de phishing ou fichiers spam.

via cyberveillecyberveille.ch

MITRE ATT&CK

Techniques & procedures

8 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1078.003Local AccountsEvidence1

Impact : ... la création de comptes administrateurs ... et la prise de contrôle complète du site. TTPs et IOCs détectés : T1078.003 — Valid Accounts: Local Accounts (Persistence).

T1190Exploit Public-Facing ApplicationEvidence3

La fonction submit_form() de la classe SUPER_Ajax, accessible sans authentification via le handler AJAX nopriv, ne valide ni le type de fichier ni l’extension. L’action AJAX super_create_nonce (nopriv) permet à tout visiteur non authentifié d’obtenir un sf_nonce valide.

Execution

1 technique

T1059.004Unix ShellEvidence2

Impact : Écriture d’un webshell PHP exécutable sur le serveur, permettant l’exécution de code arbitraire.

Persistence

3 techniques

T1078.003Local AccountsEvidence1

Impact : ... la création de comptes administrateurs ... et la prise de contrôle complète du site. TTPs et IOCs détectés : T1078.003 — Valid Accounts: Local Accounts (Persistence).

T1136Create AccountEvidence1

The article notes that arbitrary code execution through the uploaded web shell can be abused to create administrator accounts.

T1505.003Web ShellEvidence4

Impact : Écriture d’un webshell PHP exécutable sur le serveur, permettant l’exécution de code arbitraire. Le payload observé est un webshell PHP nommé Mushr00w_upl.php, utilisé comme dropper de premier niveau.

Privilege Escalation

1 technique

T1078.003Local AccountsEvidence1

Impact : ... la création de comptes administrateurs ... et la prise de contrôle complète du site. TTPs et IOCs détectés : T1078.003 — Valid Accounts: Local Accounts (Persistence).

Stealth

3 techniques

T1027Obfuscated Files or InformationEvidence1

The Super Forms request contains a Base64-encoded PHP payload presented as “data:image/gif;base64”.

T1036MasqueradingEvidence1

The Super Forms payload is prefixed with the "data:image/gif;base64" content type, but the decoded content is a PHP file-uploader web shell named "Mushr00w_upl.php."

T1078.003Local AccountsEvidence1

Impact : ... la création de comptes administrateurs ... et la prise de contrôle complète du site. TTPs et IOCs détectés : T1078.003 — Valid Accounts: Local Accounts (Persistence).

Command and Control

1 technique

T1105Ingress Tool TransferEvidence2

The uploaded PHP file is a PHP file-uploader web shell ("Mushr00w_upl.php"), which then acts as a conduit to upload additional payloads to the site.

INDICATORS OF COMPROMISE

IOCs tracked for this family

10 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

10 tracked

IPs, domains, and DNS infrastructure linked to this family.

TypeValueLatest sighting

ip.v4●●●●●●●●●●●●View more in app2 days ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

cyberveilleNews

Sep 4, 2026

Exploitation active d'une vulnérabilité critique dans le plugin WordPress Super Forms | CyberVeille

PHP web shell uploaded through exploitation of the Super Forms arbitrary-file-upload flaw. It provides server-side backdoor access and acts as a first-stage dropper for additional malware, phishing kits, or spam files.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching10

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities1

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping8

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareUsed by 1 actorExploits 1 CVE

Mushr00w_upl.php

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

1 CVES

CVE-2026-14894Unauthenticated Arbitrary File Upload in Super FormsExploited in the wild

via mkd cirtmkd-cirt.mk

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Mushr00w

Le payload observé est un webshell PHP nommé Mushr00w_upl.php, utilisé comme dropper de premier niveau pour déposer d’autres malwares, kits de phishing ou fichiers spam.

via cyberveillecyberveille.ch

MITRE ATT&CK

Techniques & procedures

8 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1078.003Local AccountsEvidence1

Impact : ... la création de comptes administrateurs ... et la prise de contrôle complète du site. TTPs et IOCs détectés : T1078.003 — Valid Accounts: Local Accounts (Persistence).

T1190Exploit Public-Facing ApplicationEvidence3

Execution

1 technique

T1059.004Unix ShellEvidence2

Impact : Écriture d’un webshell PHP exécutable sur le serveur, permettant l’exécution de code arbitraire.

Persistence

3 techniques

T1078.003Local AccountsEvidence1

Impact : ... la création de comptes administrateurs ... et la prise de contrôle complète du site. TTPs et IOCs détectés : T1078.003 — Valid Accounts: Local Accounts (Persistence).

T1136Create AccountEvidence1

The article notes that arbitrary code execution through the uploaded web shell can be abused to create administrator accounts.

T1505.003Web ShellEvidence4

Privilege Escalation

1 technique

T1078.003Local AccountsEvidence1

Impact : ... la création de comptes administrateurs ... et la prise de contrôle complète du site. TTPs et IOCs détectés : T1078.003 — Valid Accounts: Local Accounts (Persistence).

Stealth

3 techniques

T1027Obfuscated Files or InformationEvidence1

The Super Forms request contains a Base64-encoded PHP payload presented as “data:image/gif;base64”.

T1036MasqueradingEvidence1

The Super Forms payload is prefixed with the "data:image/gif;base64" content type, but the decoded content is a PHP file-uploader web shell named "Mushr00w_upl.php."

T1078.003Local AccountsEvidence1

Impact : ... la création de comptes administrateurs ... et la prise de contrôle complète du site. TTPs et IOCs détectés : T1078.003 — Valid Accounts: Local Accounts (Persistence).

Command and Control

1 technique

T1105Ingress Tool TransferEvidence2

The uploaded PHP file is a PHP file-uploader web shell ("Mushr00w_upl.php"), which then acts as a conduit to upload additional payloads to the site.

INDICATORS OF COMPROMISE

IOCs tracked for this family

10 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

10 tracked

IPs, domains, and DNS infrastructure linked to this family.

TypeValueLatest sighting

ip.v4●●●●●●●●●●●●View more in app2 days ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

cyberveilleNews

Sep 4, 2026

Exploitation active d'une vulnérabilité critique dans le plugin WordPress Super Forms | CyberVeille

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching10

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities1

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping8

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.