Undetectable Beima Webshell Sold by College Student for Tuition Hijacks 5,200+ Gov/Edu Websites

Researchers have uncovered a Beima PHP webshell operation run by a college student in Bangladesh, described as a freelance endeavour to pay for education. According to Cyderes Howler Cell Reverse Engineering Team, the Beima webshell has remained completely invisible to VirusTotal scanners for over a year and compromises thousands of government and educational websites.

The investigation traces a multi-infection backdoor chain to a Telegram marketplace where a prolific seller offers access to compromised WordPress and cPanel instances, with the student allegedly selling sites to pay for his education. Beima is sold with remote code execution capabilities and can enable attackers to extract data and enlist compromised machines into a botnet, with buyers typically paying up to around $200 for government (.gov) and education (.edu) targets, higher than the $3 to $4 standard price.

The operation is described as highly organised, using a C2 server at tool.zjtool[.]top and encrypted JSON payloads, with the webshell commands including doBeima and doLock. In total, researchers identified approximately 5,200 websites for sale in this underground market, with 76% of the compromised sites serving Government and education sectors.