Loading story…
A DFIR-focused analysis of PHP webshell detection found that hardening servers with PHP disable_functions is not sufficient to stop attackers, because command execution can still be achieved through functions such as popen and proc_open. In lab testing against common implants including p0wny-shell and Weevely, the author showed that publicly available YARA-based detections often identified only a limited subset of samples, leaving other webshells undetected on Linux web servers.
The report recommends combining signature-based scanning with broader forensic and telemetry-driven hunting. It highlights YARA sets such as THOR webshell rules, which target known families including c99, r57, PHPSPY, JspSpy, and WSO, but says defenders should also use manual investigation, file activity timelines, web log frequency analysis, file integrity monitoring, auditd, and EDR process ancestry review to uncover unknown or modified server-side backdoors.
See real exploitation activity before you spend the cycle.
3 events from the most recent confirmed update back to the earliest known activity.
A dfir.ch blog post published a defensive analysis of dangerous PHP functions and Linux webshell hunting, including lab testing of p0wny-shell, Weevely, and simple popen/proc_open shells. The post reported that tested public YARA approaches detected only limited samples and recommended combining tooling with manual investigation and timeline analysis.
The referenced THOR webshell signature set shows that rule webshell_webshell_123 was modified on 2023-01-27, indicating later maintenance of part of the 2014-era ruleset.
Florian Roth of Nextron Systems authored the THOR webshell YARA ruleset used to detect web shells and server-side backdoors across PHP, ASP, JSP, and related technologies. Most rules in the referenced set are dated 2014-01-28 or 2014-03-28.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 771 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft reported a campaign targeting Linux hosting environments in which threat actors used **HTTP cookies** as a covert control channel for PHP webshells, allowing malicious code to stay dormant unless specific cookie values were supplied. The webshells avoided obvious command delivery through URL parameters or request bodies by reading attacker input from PHP’s `$_COOKIE` superglobal, and Microsoft observed multiple variants including layered loaders, direct cookie-driven stagers, and interactive cookie-gated shells for command execution and file upload. The activity was mapped to MITRE ATT&CK techniques including `T1190`, `T1505.003`, `T1027`, `T1140`, `T1105`, `T1059.004`, `T1053.003`, and `T1222.002`. In investigated intrusions, attackers gained access through valid credentials or exploitation of known vulnerabilities, then established durable persistence by abusing legitimate hosting features such as **cPanel workflows**, **jailshell**, and **cron jobs** to repeatedly recreate obfuscated PHP loaders in web-accessible directories. Microsoft said the tradecraft relied on multi-layer obfuscation, runtime reconstruction of functions, and self-healing deployment patterns that reduced visibility in normal traffic and application logs while preserving remote code execution. The company urged defenders to enforce MFA, monitor unusual logins, restrict web server and shell interpreter execution, audit scheduled tasks, inspect suspicious file creation in web directories, and limit hosting control panel shell capabilities while enabling Defender protections on Linux.
Jun 29, 2026
Recent DFIR reporting detailed how investigators can reconstruct attacker activity from Windows and Unix artifacts while avoiding common misreads of legitimate security tooling. Securelist published deep analyses of **UserAssist** and **AmCache**, showing how `shell32.dll` updates GUI execution records, how session statistics and undocumented bytes can reveal usage patterns, and why AmCache can identify executables, drivers, shortcuts, and installed applications even after deletion, despite limits such as SHA-1 hashing only the first `31,457,280` bytes of large files. Separate research showed that **Zsh session files** can preserve command evidence even when `.zsh_history` is deleted, and that binaries wrapped with **shc** or **AutoIT** often remain recoverable or observable through runtime artifacts rather than being truly opaque. Incident write-ups and field notes also showed how attackers and defenders alike can complicate investigations. Analysts documented a typosquatted npm package, **`peritter`**, that dropped `OneDrive.exe` into Startup and stole Chrome credentials; an intrusion in which phishing, Slack installation, RDP access, and Google Drive traffic were tied to document staging and exfiltration; and broader cases in Brazilian educational institutions involving ransomware, valid-account abuse, AnyDesk, PsExec, and insider-planted malware. Other reports warned that legitimate tools and platform features can masquerade as threats or hide them: **NSSM** was used to run payloads such as `ngrok` as Windows services, Azure Batch was abused for cryptomining, RMM cleanup scripts attempted to conceal remote access software, and Microsoft Defender for Endpoint activity including **device discovery** and **Defender XDR deception accounts** generated telemetry that could be mistaken for attacker reconnaissance or privileged account misuse unless investigators validated the underlying configuration and scripts.
Aug 10, 2026
A series of DFIR case studies documented how attackers are increasingly relying on living-off-the-land techniques, uncommon runtimes, and legitimate administration tools to maintain access while evading detection. On Windows, investigators dissected a PHP backdoor that used `php-win.exe`, a scheduled task named **ClockLauncher**, and a **ClockSystemService** service to fetch and execute second-stage code invisibly; a separate intrusion used mailbombing and Microsoft Teams vishing to deliver a modular **Deno**-based RAT and proxy that persisted via the `HKCU\Run` key and communicated over WebSocket infrastructure hosted behind CloudFront. Another investigation traced a malicious `.lnk` file to a WebDAV-hosted **Remcos** payload cached under `TfsStore\Tfs_DAV`, while repeated compromises of a vulnerable **Kentico CMS** server led to webshell deployment, SEO spam, PowerShell-based payload retrieval, and installation of a malicious IIS module, **HTTPCacheLog**, that accepted commands through HTTP cookies. On Linux and cloud infrastructure, researchers showed how attackers abused both commodity malware and stealthier post-exploitation tooling. TeamTNT-linked activity used **tmate** as a covert backdoor on Linux servers, often without normal login traces, while analysis of the **REPTILE 2.0** rootkit loader showed it bypassing `insmod` by decrypting an embedded kernel module and loading it directly with the `init_module` syscall. A separate **Sysrv** botnet infection established cron persistence, masqueraded as `kthreaddk`, and included exploitation and brute-force features for propagation. In AWS, an extortion actor deleted S3 buckets and supplied a fake Linux “recovery” binary that merely simulated restoration rather than recovering cloud data. Across the investigations, defenders were urged to hunt for recurring artifacts such as scheduled tasks, Run keys, suspicious services, unusual binaries in user-writable paths, outbound SSH or WebSocket traffic, and syscall-level module loading, using telemetry and tools including **Velociraptor**, AutoRuns, Sysmon, and CloudTrail.
Aug 1, 2026