Loading story…
Attackers breached systems supporting the 14th National Games of China before the event began, likely gaining code execution through a vulnerable web server component tied to route.lua or index.lua and an upload API. Investigators found the operators uploaded reverse shells and web shells, tested file-type restrictions by disguising payloads as images, and tried to reconfigure the server to execute .lua files. When one preferred Chinese web shell setup failed, they deployed a weaponized Tomcat instance configured with Rebeyond Behinder for persistence and remote control, alongside tools including fscan, dnscrypt-proxy, and an MSSQL command utility.
Separate technical analysis identified Behinder, also known as Ice Scorpion, as a publicly available multi-platform web shell used in major intrusions including SonicWall and ProxyShell-related compromises. The malware supports command execution, file management, persistence, in-memory web shell injection, and integration with frameworks such as Meterpreter and Cobalt Strike, while using encrypted HTTP POST traffic and a hardcoded communication key derived from the MD5 hash of rebeyond. Researchers also examined a modified variant, rebeyond-Mode, which adds decoy pages and command obfuscation while reusing Behinder payloads and the same hardcoded key, underscoring how adaptable the tool remains for post-exploitation operations.
Pull IOCs and campaign context straight into your stack.
9 events from the most recent confirmed update back to the earliest known activity.
The 14th National Games of China began in Shaanxi after the breach had apparently been successfully resolved before the event started.
Researchers concluded the attackers probably achieved initial code execution at around 10:00 AM local time by exploiting a web-server vulnerability, possibly involving route.lua or index.lua with an upload API.
Avast reported that attackers tested allowed file types and extensions on systems hosting content for the 14th National Games of China, repeatedly uploading the same benign image under different extensions to probe execution paths.
The article states that a Java error impacting Behinder's anti-detection-related functionality had been a known open issue since June 2021.
The Behinder web shell gained an in-memory web-shell injection feature called MemShell in an April 2021 update, expanding its persistence and post-exploitation capabilities.
The attackers placed tools including fscan, dnscrypt-proxy, mssql-command-tool, and Behinder on the compromised server, then used a Go-based exploitation framework and fscan to fingerprint services, brute-force credentials, and attempt lateral movement.
When their preferred Chinese web-shell setup did not work, the attackers uploaded and ran a Tomcat server configured with Rebeyond Behinder to maintain access and control.
The intruders uploaded a www.conf file disguised as a PNG in an effort to reconfigure the web server so that .lua files would execute, supporting their preferred shell deployment method.
After initial access, the attackers uploaded multiple reverse shells and web shells, including Lua and PHP payloads, and used proof-of-concept scripts to test what execution was possible on the target environment.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Palo Alto Networks Unit 42 reported a **previously undocumented Chinese threat actor**, tracked as **CL-UNK-1068**, conducting a multi-year intrusion campaign (observed since at least 2020) against high-value organizations across **South, Southeast, and East Asia**. Targeted sectors include **aviation, energy, government, law enforcement, pharmaceutical, technology, and telecommunications**, with Unit 42 assessing **moderate-to-high confidence** that the primary objective is **cyber espionage** (while not fully ruling out criminal motives). The assessment cites tool provenance, linguistic artifacts in configurations, and consistent long-term targeting of Asian critical infrastructure as key factors supporting attribution. The activity features exploitation of **internet-facing web servers** to deploy **web shells** and establish persistence across both Windows and Linux environments, using a mix of custom malware, modified open-source tools, and **living-off-the-land binaries (LOLBINs)**. Reported tooling includes **Godzilla** and **ANTSWORD** web shells, the **Xnote** Linux backdoor, and **Fast Reverse Proxy (FRP)** for tunneling/relay; post-compromise behavior includes lateral movement and targeted file theft from Windows web servers (e.g., `c:\inetpub\wwwroot`) focusing on files such as `web.config`, `.aspx`, `.asmx`, `.asax`, and `.dll`, consistent with credential access and follow-on exploitation discovery.
Jun 29, 2026
Trend Micro disclosed that the China-aligned cluster **SHADOW-EARTH-053** compromised more than a dozen organizations in at least eight countries by exploiting vulnerable Microsoft Exchange and IIS servers, including the `ProxyLogon` chain, then deploying **GODZILLA** web shells and the **ShadowPad** backdoor to maintain access. Victims included government agencies, defense contractors, technology firms, transportation organizations, and at least one target in Poland, with activity observed from December 2024 through April 2026. Researchers said the intrusions resemble broader Chinese state-linked operations such as Salt Typhoon and Volt Typhoon and may support long-term espionage, prepositioning, and potential future disruption. Post-compromise activity included DLL sideloading with a renamed Toshiba Bluetooth Stack executable, registry-resident shellcode execution via `EnumDesktopsA` callback injection, scheduled-task persistence, mailbox collection from Exchange, credential theft, and lateral movement using tools such as **IOX**, **GOST**, **Wstunnel**, **Sharp-SMBExec**, **Mimikatz**, and **Evil-CreateDump**. Trend Micro also identified overlap with a related cluster, **SHADOW-EARTH-054**, including shared tool hashes, reused vulnerabilities, and compromises at some of the same organizations, although the company assessed the relationship as overlapping exploitation rather than clearly coordinated operations. Defenders were urged to patch Exchange and IIS systems quickly and review IIS worker process activity, web-shell indicators, and other signs of stealthy post-exploitation.
Jun 29, 2026
Researchers linked multiple Linux intrusions to a Romanian-speaking threat cluster that brute-forced weak SSH credentials, compromised servers and network devices at scale, and deployed a Perl-based **Shellbot** with IRC command-and-control. Trend Micro found infrastructure capable of generating target lists covering roughly **80 million IP addresses**, logs indicating more than **65,000 potentially compromised hosts**, and tooling including the **Haiduc** SSH brute-forcer, process-masquerading utility **Faker**, privilege-escalation exploits such as `CVE-2017-16995` and Dirty Cow variants, and high-availability C2 built with CARP. Bitdefender separately tied a likely Romanian group to Linux-focused scanning, SHC-obfuscated loaders, Discord webhook reporting, a customized Perl IRC bot, and a Golang SSH bruteforcer offered in a SaaS-like model, with monetization centered on **Monero** mining via customized **XMRig** payloads. Additional reporting showed the campaign’s tradecraft remained active across traditional servers and cloud-native environments. JPCERT/CC documented attackers using stolen SSH access to move laterally, install **XMRig**, hide mining with **XHide**, tamper with logs, and continue scanning for new SSH targets, while Sysdig observed Shellbot compromise a Tomcat container through brute-forced default credentials, download multi-architecture payloads, establish persistence, erase traces, and receive commands for file transfer, port scanning, data exfiltration, and **DDoS** attacks. Together, the reports describe a long-running Linux-focused operation that blends brute-force access, worm-like propagation, cryptojacking, and botnet functionality across exposed infrastructure.
Aug 15, 2026