Loading story…
Microsoft reported a campaign targeting Linux hosting environments in which threat actors used HTTP cookies as a covert control channel for PHP webshells, allowing malicious code to stay dormant unless specific cookie values were supplied. The webshells avoided obvious command delivery through URL parameters or request bodies by reading attacker input from PHP’s $_COOKIE superglobal, and Microsoft observed multiple variants including layered loaders, direct cookie-driven stagers, and interactive cookie-gated shells for command execution and file upload. The activity was mapped to MITRE ATT&CK techniques including T1190, T1505.003, T1027, T1140, T1105, T1059.004, T1053.003, and T1222.002.
In investigated intrusions, attackers gained access through valid credentials or exploitation of known vulnerabilities, then established durable persistence by abusing legitimate hosting features such as cPanel workflows, jailshell, and cron jobs to repeatedly recreate obfuscated PHP loaders in web-accessible directories. Microsoft said the tradecraft relied on multi-layer obfuscation, runtime reconstruction of functions, and self-healing deployment patterns that reduced visibility in normal traffic and application logs while preserving remote code execution. The company urged defenders to enforce MFA, monitor unusual logins, restrict web server and shell interpreter execution, audit scheduled tasks, inspect suspicious file creation in web directories, and limit hosting control panel shell capabilities while enabling Defender protections on Linux.
Get the actors, campaigns, and ATT&CK mapping behind it.
3 events from the most recent confirmed update back to the earliest known activity.
Microsoft Defender Security Research publicly described a campaign in which PHP webshells on Linux servers used HTTP cookies as a covert control channel, detailing multiple variants, layered obfuscation, and MITRE ATT&CK mappings.
After compromise, the attackers used legitimate hosting features such as cPanel workflows, jailshell, and cron jobs to repeatedly recreate obfuscated PHP loaders in web-accessible directories, creating durable self-healing persistence.
In investigated incidents, threat actors gained initial access to Linux hosting servers using valid credentials or by exploiting a known vulnerability, then deployed PHP-based webshell components on the compromised hosts.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
thehackernews.com
Open sourcemicrosoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A DFIR-focused analysis of PHP webshell detection found that hardening servers with PHP `disable_functions` is not sufficient to stop attackers, because command execution can still be achieved through functions such as `popen` and `proc_open`. In lab testing against common implants including **p0wny-shell** and **Weevely**, the author showed that publicly available YARA-based detections often identified only a limited subset of samples, leaving other webshells undetected on Linux web servers. The report recommends combining signature-based scanning with broader forensic and telemetry-driven hunting. It highlights YARA sets such as **THOR webshell** rules, which target known families including **c99**, **r57**, **PHPSPY**, **JspSpy**, and **WSO**, but says defenders should also use manual investigation, file activity timelines, web log frequency analysis, file integrity monitoring, `auditd`, and EDR process ancestry review to uncover unknown or modified server-side backdoors.
Aug 1, 2026
A series of DFIR case studies documented how attackers are increasingly relying on living-off-the-land techniques, uncommon runtimes, and legitimate administration tools to maintain access while evading detection. On Windows, investigators dissected a PHP backdoor that used `php-win.exe`, a scheduled task named **ClockLauncher**, and a **ClockSystemService** service to fetch and execute second-stage code invisibly; a separate intrusion used mailbombing and Microsoft Teams vishing to deliver a modular **Deno**-based RAT and proxy that persisted via the `HKCU\Run` key and communicated over WebSocket infrastructure hosted behind CloudFront. Another investigation traced a malicious `.lnk` file to a WebDAV-hosted **Remcos** payload cached under `TfsStore\Tfs_DAV`, while repeated compromises of a vulnerable **Kentico CMS** server led to webshell deployment, SEO spam, PowerShell-based payload retrieval, and installation of a malicious IIS module, **HTTPCacheLog**, that accepted commands through HTTP cookies. On Linux and cloud infrastructure, researchers showed how attackers abused both commodity malware and stealthier post-exploitation tooling. TeamTNT-linked activity used **tmate** as a covert backdoor on Linux servers, often without normal login traces, while analysis of the **REPTILE 2.0** rootkit loader showed it bypassing `insmod` by decrypting an embedded kernel module and loading it directly with the `init_module` syscall. A separate **Sysrv** botnet infection established cron persistence, masqueraded as `kthreaddk`, and included exploitation and brute-force features for propagation. In AWS, an extortion actor deleted S3 buckets and supplied a fake Linux “recovery” binary that merely simulated restoration rather than recovering cloud data. Across the investigations, defenders were urged to hunt for recurring artifacts such as scheduled tasks, Run keys, suspicious services, unusual binaries in user-writable paths, outbound SSH or WebSocket traffic, and syscall-level module loading, using telemetry and tools including **Velociraptor**, AutoRuns, Sysmon, and CloudTrail.
Aug 1, 2026
Australia’s ACSC warned of a large-scale global campaign exploiting vulnerable content management systems and plugins to install webshells on internet-facing web servers, with many small and medium-sized Australian businesses affected. Attackers are scanning for known flaws in **WordPress plugins** and other CMS platforms including **Craft CMS**, **MaxSite CMS**, **MetInfo CMS**, and **Joomla JCE**, abusing weaknesses such as unauthenticated file upload, remote code execution, server-side request forgery, and unsafe deserialization. The implanted webshells give attackers persistent remote access that can be used for website defacement, credential theft, malware delivery, and deeper network intrusion. ACSC said organizations should treat any server hosting a webshell as **fully compromised**, isolate affected systems, inspect logs for lateral movement and persistence, restore from known-good backups after patching, and reduce future exposure by rapidly applying patches, disabling vulnerable plugins, restricting file creation and execution paths, monitoring child processes, and limiting connectivity between public-facing web servers and internal networks.
Aug 25, 2026