Server Software Component: Web Shell, Sub-technique T1505.003 - Enterprise
Excerpt
C0034 2022 Ukraine Electric Power Attack
During the 2022 Ukraine Electric Power Attack, Sandworm Team deployed the Neo-REGEORG webshell on an internet-facing server.
[3]
G1030 Agrius
Agrius typically deploys a variant of the ASPXSpy web shell following initial access via exploitation.[4] G0007 APT28
APT28 has used a modified and obfuscated version of the reGeorg web shell to maintain persistence on a target's Outlook Web Access (OWA) server.
[5]
G0016 APT29
APT29 has installed web shells on exploited Microsoft Exchange servers.[6][7]
G0050 APT32
APT32 has used Web shells to maintain access to victim websites.[8]
G0082 APT38
APT38 has used web shells for persistence…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by MITRE ATT&CK on attack.mitre.org.
Mentioned in the excerpt
More from MITRE ATT&CK43
- techdoc_lite-deliverables-numbered option.dotxMITRE ATT&CK · Added 16 Jun
- Cross-Platform Detection of Data Transfer to Cloud Account, Detection Strategy DET0573MITRE ATT&CK · Added 6 Apr
- Encrypted Channel, Technique T1573 - EnterpriseMITRE ATT&CK · Added 6 Apr
- Boot or Logon Autostart Execution: Time Providers, Sub-technique T1547.003 - EnterpriseMITRE ATT&CK · Added 6 Apr
On the same topics
- ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoftMandiant (Google) · Published 25 Sep
- TA488 Targets Zimbra Mailservers with Half-Click ExploitsProofpoint · Published 15 Jul
- Beyond the Archive: CVE-2025-8088 Stealer Targeting Ukrainebluecyber.hashnode.dev · Published 22 Jul
- DragonBreath: Dragon in the Kernelransom-isac.com · Published 22 Apr
