Neo-reGeorgMalware
Neo-reGeorg is an open-source web shell designed as a restructuring of reGeorg with improved usability, security, and fixes for exising reGeorg bugs.From MITRE ATT&CK
Last reported 26 days ago, by SecurityWeek7 reports
ATT&CK techniques
6 of 79 · each with the sentence it comes from- T1505.003Web Shell
“T1505.003 Web Shell”
- T1036Masquerading
“Hunt for Sliver implant indicators, including process masquerading and beacon traffic to 46.8.236.121:11008 / 11009 at 60-second mTLS check-in intervals.”
- T1190Exploit Public-Facing Application
“T1190 Exploit Public-Facing Application”
- T1027Obfuscated Files or Information
“T1027 Obfuscated Files or Information”
- T1059Command and Scripting Interpreter
“T1059.003 Command and Scripting Interpreter: Windows Command Shell”
- T1082System Information Discovery
“T1082 System Information Discovery”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
7 reports, newest first · the exact sentence from each-
Google Warns of ShinyHunters’ Fresh Oracle PeopleSoft Campaign“Additionally, the attackers deployed the open source Neo-reGeorg tunneling toolkit for internal discovery and lateral movement, and the open source remote management platform MeshCentral.”
-
Operation Talked: A Russia-Linked Cyber Espionage Campaign Targeting Ukraine’s Defense Industry“…E” (130.12.182.216, taken down, July 23, 2026), and several webshell and tunnel relays running Godzilla ASPX, suo5, r57, reGeorg, and Neo-reGeorg.”
-
Attackers Bypass WAFs to Exploit Oracle PeopleSoft Flaw and Deploy Web Shells“"Alongside the deployment of Ple64.exe, the threat actor staged the open-source Neo-reGeorg tunneling toolkit," Google said.”
-
ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft“Alongside the deployment of Ple64.exe, the threat actor staged the open-source Neo-reGeorg tunneling toolkit and deployed its tunnel.jsp and tunnel.jspx servlets into victim web directories.”
-
NightEagle targets Russian companies“It incorporates components from several open-source projects, including the Neo-reGeorg tunnel, an exploit for the CVE-2020-0688 vulnerability, and the GhostWebShell class from the ysoserial utility.”
-
JadeProx: Tracing a China-nexus Operation Through an OPSEC Mistake“Neo-reGeorg”
-
Vibe Hacking: Two AI-Augmented Campaigns Target Government and Financial Sectors in Latin America“Despite sharing tools and tactics, including Chisel, Neo-reGeorg, CrackMapExec, and Impacket, SHADOW-AETHER-040 and SHADOW-AETHER-064 appear to be distinct groups, separated primarily by language: Spanish and Portuguese respectively.”
Indicators in its reports
named in the reports above- 162.219.30[.]165in 2 reports
- hxxps://github[.]com/mirror-js/mirror-js/refs/heads/main/js/js-webpack.zipin 1 report
- hxxps://github[.]com/mirror-js/mirror-js/refs/heads/main/js/jsonp-pack.zipin 1 report
- hxxps://github[.]com/browserthemes/resourcepack/releases/download/main/resource-pack.zipin 1 report
- devtunnels[.]msin 1 report
- 1dcafb7f8448683281106b06dd22409ain 1 report
- 1f3034b706c78b35d8e34044e68c693ain 1 report
- 3ecd1cd627d0340c92901a478a7caad8in 1 report
- 631fb131a56caf4ca0f287ed73e876abin 1 report
- 4aa9fb1bf9223dfcdac920759bc7a3c7in 1 report
- hxxps://github[.]com/mirror-js/mirror-jsin 1 report
- hxxps://github[.]com/browserthemes/resourcepackin 1 report
Copy these 12 indicators · defanged
Thanks — we review every report.