MITRE ATT&CKsoftware (malware)

S9028 PHPsert

Published 2026-04-19 Modified 2026-05-12 Official page ↗
Domain
enterprise
Platforms
Network Devices
Version
1.0
Created
2026-04-19

Description

PHPsert is a webshell used to execute PHP code that has been in use since at least 2023 against targets in Japan, Singapore, Peru, Taiwan, Iran, Republic of Korea, and the Philippines. PHPsert is not typically deployed as a standalone but integrated into web content such as text editors and content management systems.

Related

Uses · MITRE ATT&CK (6)

  • T1027.013 Encrypted/Encoded File sub-technique
  • T1071.001 Web Protocols sub-technique
  • T1132.001 Standard Encoding sub-technique
  • T1505.003 Web Shell sub-technique
  • T1140 Deobfuscate/Decode Files or Information technique
  • T1105 Ingress Tool Transfer technique

Referenced by MITRE ATT&CK · uses (1)

  • C0061 Operation Digital Eye campaign

References