VShellMalware
VShell is an OST framework written in Go, enabling availability of implants for multiple platforms (Windows, Linux, macOS).From MISP Galaxy
Last reported 17 days ago, by AhnLab ASEC8 reports
ATT&CK techniques
6 of 14 · each with the sentence it comes from- T1505.003Web Shell
“It also describes, through actual attack cases, the patterns in which web shells, backdoors, CoinMiner, and VPN tools are used in combination.”
- T1053.005Scheduled Task
“Persistence was achieved by registering the malware in the Startup folder and creating scheduled tasks.”
- T1003.006DCSync
“… observed the group dropping and executing a binary called newdcsync, which, based on the command line and filename, was likely used for DCSync attacks.”
- T1014Rootkit
“For persistence, combinations of rootkits, backdoors, and loaders are used.”
- T1021.001Remote Desktop Protocol
“We also observed the group deploying a suspected custom remote desktop protocol (RDP) launcher (under the name smss.exe) and a C# implementation of SMBExec known as Sharp-SMBExec.”
- T1047Windows Management Instrumentation
“SHADOW-EARTH-053 uses Windows Management Instrumentation Command-line (WMIC) for lateral movement, installing backdoors and tools onto additional hosts.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
8 reports, newest first · the exact sentence from each-
Q3 2026 Statistical Report on Malware Targeting Windows Database Servers“VShell (a Go-based backdoor) was also used, providing remote command execution and file management capabilities.”
-
Roundcube SQL injection CVE-2026-48842 is now being exploited in the wild“…ty by a suspected China-nexus actor tracked as UNK_MassTraction, which exploited known Roundcube vulnerabilities to deploy web shells or VShell, a post-exploitation tool.”
-
Roundcube Pre-Auth SQL Injection Flaw Actively Exploited in the Wild“… adversary dubbed UNK_MassTraction exploiting known security flaws in Roundcube to deliver web shells or a post-exploitation tool called VShell.”
-
July 2026 Threat Trend Report on APT Groups“UNK_MassTraction repeatedly exploited Roundcube vulnerabilities to infiltrate university networks and used IceCube, SquareShell, and VShell.”
-
Advent of Configuration Extraction, Part 3: SNOWLIGHT Config“It has been incorporated into UNC5174 campaigns as an in-memory loader for the VShell remote access trojan.”
-
Inside Shadow-Earth-053: A China-Aligned Cyberespionage Campaign Against Government and Defense Sectors in Asia“Meanwhile, for SHADOW-EARTH-054, we found multiple malware loaders that we could not attribute, and a VShell sample that communicates with 209.141.40.254.”
-
JSAC2026 -Day 2-“The malware used in the campaign included ValleyRAT and VShell.”
-
JSAC2026 -Day 1-“…ter gaining access, the operators deployed SnakeC2, NEOBEACON (which abuses OneDrive and the Microsoft Graph API for C2), Cobalt Strike, VShell, and SoftEther VPN.”
Indicators in its reports
named in the reports above- 4264cfb3980a068a…40e59885f5c8in 1 report
- 2e8f9fd8213d9f69…93d881c04cd2in 1 report
- 8d9433e9734dd629…d344de733c78in 1 report
- d67197bf407e74ec…7df65cf429b3in 1 report
- 141.164.46[.]77in 1 report
- 96.9.125[.]227in 1 report
- 194.38.11[.]3in 1 report
- check.office365-update[.]comin 1 report
- 209.141.40[.]254in 1 report
- zimbra-beta[.]infoin 1 report
- 344c391cfd4fd304…b3c6c4cbbb29in 1 report
- rel.symbol[.]namein 1 report
- symbol[.]namein 1 report
- instr[.]idin 1 report
- 056ffa80af31d17e0cee037b44e0c7efin 1 report
- 0eb0f57afd54c9733c720fbac82b754bin 1 report
- 216ae88b735790f27a17a9868e5202b8in 1 report
- 31595e7e73bde0326a4d5054615249cfin 1 report
- 3de6a8f367d5d9f0a71fb5f1443c0e8fin 1 report
- hxxps://ams-pub-dev.s3.dualstack.eu-west-1.amazonaws[.]com/test/hub/update.zipin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.