MITRE ATT&CKsoftware (malware)
S0020 China Chopper
- Domain
- enterprise
- Platforms
- Windows
- Version
- 2.5
- Created
- 2017-05-31
Description
China Chopper is a Web Shell hosted on Web servers to provide access back into an enterprise network that does not rely on an infected system calling back to a remote command and control server. It has been used by several threat groups.
Related
Uses · MITRE ATT&CK (10)
- T1071.001 Web Protocols sub-technique
- T1059.003 Windows Command Shell sub-technique
- T1110.001 Password Guessing sub-technique
- T1027.002 Software Packing sub-technique
- T1070.006 Timestomp sub-technique
- T1505.003 Web Shell sub-technique
- T1005 Data from Local System technique
- T1046 Network Service Discovery technique
- T1083 File and Directory Discovery technique
- T1105 Ingress Tool Transfer technique
References
- https://us-cert.cisa.gov/ncas/alerts/aa21-200a CISA AA21-200A APT40 July 2021
- https://www.secureworks.com/research/threat-group-3390-targets-organizations-for-cyberespionage Dell TG-3390
- https://www.rapid7.com/blog/post/2021/03/23/defending-against-the-zero-day-analyzing-attacker-behavior-post-exploitation-of-microsoft-exchange/ Rapid7 HAFNIUM Mar 2021
- https://www.fireeye.com/blog/threat-research/2018/03/suspected-chinese-espionage-group-targeting-maritime-and-engineering-industries.html FireEye Periscope March 2018
- https://www.fireeye.com/blog/threat-research/2013/08/breaking-down-the-china-chopper-web-shell-part-i.html Lee 2013