value:  GALLIUM used Web shells to persist in victim environments and assist in execution and exfiltration. ;; HAFNIUM has deployed multiple web shells on compromised servers including SIMPLESEESHARP SPORTSBALL China Chopper and ASPXSpy. ;; Kimsuky has used modified versions of open source PHP web shells to maintain access often adding Dinosaur" references within the code. ;; Leviathan relies on web shells for an initial foothold as well as persistence into the victim's systems. ;; OilRig has used web shells often to maintain access to a victim network. ;; Operation Wocao has used their own web shells as well as those previously placed on target systems by other threat actors for reconnaissance and lateral movement. ;; OwaAuth is a Web shell that appears to be exclusively used by Threat Group-3390. It is installed as an ISAPI filter on Exchange servers and shares characteristics with the China Chopper Web shell. ;; P.A.S. Webshell can gain remote access and execution on target web servers. ;; Sandworm Team has used webshells including P.A.S. Webshell to maintain access to victim networks. ;; SEASHARPEE is a Web shell. ;; SUPERNOVA is a Web shell. ;; TEMP.Veles has planted Web shells on Outlook Exchange servers. ;; Threat Group-3390 has used a variety of Web shells. ;; Tropic Trooper has started a web service in the target host and wait for the adversary to connect acting as a web shell. ;; Volatile Cedar can inject web shell code into a server. "
name: Server Software Component: Web Shell