Article
Software Shared Across ATT&CK Groups: Reuse Study
MITRE ATT&CK v19.2 data: Mimikatz is linked to 51 of 176 groups, while 503 of 607 software entries tie to one group. See the…
Read more
Malware profile
China Chopper
Also known as caidao.exe
China Chopper is a small web shell that attackers place on a web server to get remote access to it.
In short
China Chopper is a small web shell that attackers place on a web server to get remote access to it. It has a client the attacker runs and a server part that sits on the victim server. UK and partner agencies describe it as a publicly available tool used by hostile actors to manage files and open a terminal on compromised web servers.
- Names2names in public reportsChina Chopper · caidao.exe
- Techniques10ATT&CK techniques listedPersistence · Execution · Command and Control
- Infection Steps4in the delivery chainServer compromised · Web shell uploaded
- Linked Groups3groups that use itAPT40 threat group profile · APT41 · Mustang Panda
In one minute
- What it is
- A small web shell that gives an attacker remote control of a web server.
- What it does
- Lets the attacker run terminal commands, manage, upload and download files, and change file timestamps on the compromised server.
- Who uses it
- MITRE ATT&CK lists APT40, APT41 and Mustang Panda as users. CISA and the FBI, in advisory AA21-200A of 19 July 2021, name China Chopper among the tools used by APT40.
- How it gets in
- Installed after a web application flaw or weak configuration on a web server is abused, as described by CISA and the NCSC.
- What to do first
- Patch public-facing web servers and check them on the host for web shells and unexpected files, as the NCSC advises.
What it does
A web shell is a script placed on a web server so an attacker can control the machine from outside. China Chopper is one of the best known examples. Because it sits on the server, it does not need the infected machine to call back to a separate command server.
The UK National Cyber Security Centre says the tool is only about 4 Kb in size and its payload is easy to change. It says this makes detection and mitigation difficult for network defenders.
Names
Public sources use several names for this malware.
| Name | Where it appears |
|---|---|
| China Chopper | MITRE ATT&CK software S0020 and the NCSC joint report on publicly available hacking tools[1, 2] |
| caidao.exe | File name of the China Chopper client in the NCSC joint report[2] |
What it can do
What MITRE ATT&CK lists this malware as doing, by tactic. Each id opens our technique page where one exists, otherwise MITRE.
Persistence
Execution
Command and Control
Collection
Discovery
Credential Access
How it spreads
China Chopper does not spread by itself. The NCSC says web shells are uploaded to a target host after an initial compromise. CISA says web shells are commonly installed through web application vulnerabilities or configuration weaknesses, such as SQL injection, file upload flaws and exposed admin interfaces. In summer 2018 the NCSC report describes attackers targeting public-facing servers with CVE-2017-3066 in Adobe ColdFusion and using China Chopper as the second-stage payload.
How an infection runs
The order of steps in a typical infection, as the sources describe it.
Server compromised
An attacker abuses a vulnerability on a public-facing web server. In summer 2018 the NCSC report names CVE-2017-3066 in Adobe ColdFusion.[2]
Web shell uploaded
The text-based China Chopper server file is placed on the victim web server.[2]
Attacker connects
The attacker uses the client application to reach the web shell at any time.[2]
Files and data handled
Once connected, the attacker manipulates files and data on the web server.[2]
Timeline
- 2012
In widespread use
The NCSC report says China Chopper has been in widespread use since 2012.[2]
- 10 November 2015
CISA web shell alert
CISA issued alert TA15-314A with UK, Australian, Canadian and New Zealand partners. It names China Chopper as a web shell frequently chosen by adversaries.[4]
- Summer 2018
ColdFusion attacks
The NCSC report says threat actors targeted web servers with CVE-2017-3066 and used China Chopper as the second-stage payload.[2]
- 11 October 2018
Joint report on hacking tools
The NCSC published a joint report from agencies of five nations that covers China Chopper.[3]
- 19 July 2021
APT40 advisory
CISA and the FBI published AA21-200A on APT40 after the US Department of Justice unsealed an indictment against four APT40 actors. China Chopper is in the malware list.[5]
Who uses it
- Threat group APT40 threat group profile APT40 (tracked by MITRE as Leviathan) is attributed by the US and UK governments (2021) and by agencies in eight countries (2024) to China's Ministry of State Security. China · Since 2009
- Threat group APT41 MITRE describes APT41 as a Chinese state-sponsored espionage group, as researchers have assessed it, that also runs financially motivated operations. China · Since 2012
- Threat group Mustang Panda MITRE ATT&CK describes Mustang Panda as a China-based cyber espionage threat actor, and the US Department of Justice, citing court documents, says the PRC government paid the group to develop a version of PlugX. China · Since 2012
Seen in
Detection and defense
Questions
What is China Chopper?
A web shell, a script on a web server that gives an attacker remote access. MITRE describes it as hosted on web servers and not relying on an infected system calling back to a command server.
How big is China Chopper?
The NCSC says it is just 4 Kb in size and has an easily modifiable payload, which makes detection difficult.
Who uses China Chopper?
MITRE ATT&CK lists several groups, including APT40, APT41 and Mustang Panda. CISA and the FBI list it among the tools used by APT40 in advisory AA21-200A.
How is China Chopper detected?
The NCSC says the most effective way is on the host itself, on public-facing web servers. Every action generates an HTTP POST, which can be spotted in logs, though TLS makes network tools less effective.
In our research
- Software Shared Across ATT&CK Groups: Reuse Study October 2026
- APT27 threat group profile Threat group
- APT40 threat group profile Threat group
- APT41 Threat group
- HAFNIUM Threat group
- Mustang Panda Threat group
Sources
- China Chopper, Software S0020 MITRE ATT&CKSupports: Description, platform, techniques and groups listed for China Chopper.
- Joint report on publicly available hacking tools (PDF) NCSC UK with ACSC, CCCS, NZ NCSC and US partnersSupports: Use since 2012, size, capabilities, CVE-2017-3066 use in 2018 and detection advice.
- Joint report on publicly available hacking tools NCSC UKSupports: Publication date of 11 October 2018.
- TA15-314A Compromised Web Servers and Web Shells CISASupports: Web shell delivery, prevention and detection guidance, and the November 2015 release.
- AA21-200A Tactics, Techniques, and Procedures of Indicted APT40 Actors CISA and FBISupports: China Chopper listed among APT40 tools, July 2021 indictment and mitigations.
- APT41, Group G0096 MITRE ATT&CKSupports: MITRE lists APT41 as a user of China Chopper.
- Mustang Panda, Group G0129 MITRE ATT&CKSupports: MITRE lists Mustang Panda as a user of China Chopper.
- Leviathan, Group G0065 MITRE ATT&CKSupports: MITRE lists Leviathan, the MITRE name for APT40, as a user of China Chopper.
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.