reGeorgMalware
reGeorg is an open-source web shell written in Python that can be used as a proxy to bypass firewall rules and tunnel data in and out of targeted networks.From MITRE ATT&CK
Last reported 28 days ago, by SOCRadar1 report
ATT&CK techniques
6 of 17 · each with the sentence it comes from- T1003.001LSASS Memory
“T1003.001 LSASS Memory”
- T1021.006Windows Remote Management
“T1021.006 WinRM”
- T1036Masquerading
“Hunt for Sliver implant indicators, including process masquerading and beacon traffic to 46.8.236.121:11008 / 11009 at 60-second mTLS check-in intervals.”
- T1087.002Domain Account
“T1087.002 Domain Account Discovery”
- T1090.003Multi-hop Proxy
“T1090.003 Multi-hop Proxy”
- T1133External Remote Services
“T1133 External Remote Services”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
Operation Talked: A Russia-Linked Cyber Espionage Campaign Targeting Ukraine’s Defense Industry“… / EMPIRE ENGINE” (130.12.182.216, taken down, July 23, 2026), and several webshell and tunnel relays running Godzilla ASPX, suo5, r57, reGeorg, and Neo-reGeorg.”
Indicators in its reports
named in the reports above- 129.146.87[.]174in 1 report
- 130.12.182[.]216in 1 report
- db848d928afe4d2284a35bb112720e6fin 1 report
- 46.8.236[.]121in 1 report
- 24.106.41[.]154in 1 report
- 46.44.231[.]122in 1 report
- 213.96.47[.]74in 1 report
- 71.245.184[.]24in 1 report
- b2d46bfc25df83dd…c46257d13be8in 1 report
- e27f5b057a0de14ab32fb9e7462f04cfin 1 report
- 65d96bd51d8a1cbd…e9bd64103992in 1 report
- 3ba4e04fdcf73c267b89d91fc90f836fin 1 report
Copy these 12 indicators · defanged
Thanks — we review every report.