Article
Storm-3358 and ARTEX: How a Financial-Sector Intrusion Campaign Works
Storm-3358 ARTEX attacks hit financial firms from October 2026: anonymous upload and SSRF entry, WISP and vshell RATs, and what to check first.
Read more
Attack technique
Server Software Component: Web Shell (T1505.003)
A web shell is a small script that an attacker places on a web server.
In short
A web shell is a small script that an attacker places on a web server. It lets the attacker run commands on that server from a distance. Because it sits on the server itself, it keeps working even if the first way in is closed, which is why attackers use it to keep access to the network over time.
- Reconnaissance
- Resource Development
- Initial Access
- Execution
- Persistence
- Privilege Escalation
- Stealth
- Defense Impairment
- Credential Access
- Discovery
- Lateral Movement
- Collection
- Command and Control
- Exfiltration
- Impact
Persistence · Step 5 Of 15 In The Attack Chain
- MITRE IDT1505.003ATT&CK technique
- Detection4ways to spot itNew scripts in web folders · Web server starting shells
- Defences3ways to stop itTurn off risky functions · Audit server components
How it works
Attackers put a web shell on a server that they can reach from the internet. The shell is a script that the web server runs like any other page.
The script gives the attacker a way to run commands or use a command line on the server. It is often paired with a client program that the attacker uses to talk to it.
Because the shell sits on the server itself, it keeps working even if the attacker’s first way in is closed. This is why MITRE files it under persistence, as one case of abusing server software components.
A real example
- MITRE ATT&CK lists China Chopper as having a server component that is itself a web shell payload.
- MITRE ATT&CK lists Agrius as typically deploying a variant of the ASPXSpy web shell after gaining initial access through exploitation.
- MITRE ATT&CK lists APT28 as using a modified and obfuscated version of the reGeorg web shell to keep access to a target's webmail server.
- MITRE ATT&CK lists APT5 as installing multiple web shells on compromised servers, including on VPN appliances.
- MITRE ATT&CK lists BUSHWALK as a web shell that can run arbitrary commands or write files.
- In September and October 2026, admins reported PHP web shells in the app folder of Nextcloud servers attacked through CVE-2026-110447. See our Nextcloud Collabora CODE Server news post.
- Sansec reported on 24 October 2026 that a Magento CMS block loader reached 471 stores in one hour in March. The operator first uploaded web shells through the PolyShell flaw (CVE-2026-48356). CISA added that CVE to its Known Exploited Vulnerabilities catalog on 27 October 2026. See our Magento CMS block loader news post.
Who uses it
- Ransomware group BianLian BianLian is a ransomware and data extortion group that the FBI, CISA and Australia's ACSC say is likely based in Russia. Active · Since 2022 · Developer and deployer group with Russia-based affiliates
- Ransomware group Cl0p Cl0p is a ransomware operation first seen in February 2019 and, per a joint FBI and CISA advisory (AA23-158A, June 2023), also known as TA505. Active · Since 2019 · Ransomware as a service, and data theft campaigns (per the advisory)
Seen in incidents
- Incident Microsoft Exchange ProxyLogon mass exploitation, 2021 The Microsoft Exchange ProxyLogon attacks of early 2021 used four previously unknown flaws in on-premises Exchange Server to reach email servers around the world. March 2021 · Multiple sectors
- Incident MirrorFace campaigns against Japan, 2019 to 2025 On 8 January 2025 Japan's National Police Agency (NPA) and the National center of Incident readiness and Strategy for Cybersecurity (NISC) said that cyberattack campaigns against Japanese organizations since about 2019 were run by an actor called MirrorFace. 2019 to 2025 · Government and public sector
- Incident SharePoint ToolShell attacks In July 2025, attackers exploited flaws in on-premises Microsoft SharePoint Server in an attack chain called ToolShell. July 2025 · Multiple sectors
How to detect
-
New scripts in web folders
Watch for files created in web directories that nobody planned, especially scripts that are not part of normal site updates.
-
Web server starting shells
Look for the web server process starting command shells or unexpected system utilities soon after a new file appears.
-
Log sources
MITRE points to process execution, file creation events and web server activity logs as the data to review.
-
Data sources MITRE lists
File Creation, File Modification, Logon Session Creation, Network Traffic Content, Process Creation
How to defend
-
Turn off risky functions
Consider disabling functions in web technologies, such as PHP's eval(), that can be abused.
-
Limit who can change web folders
Apply least privilege so only authorized accounts can modify web directories.
-
Audit server components
MITRE's guidance for server software components also advises regular checks for unexpected changes and turning off unneeded server features.
Questions
What is a web shell?
A web shell is a script placed on a web server that the server runs like any other page. It gives the attacker a way to run commands or use a command line on the server.
Why do attackers use web shells?
The shell sits on the server itself, so it keeps working even if the attacker's first way in is closed. This is why MITRE files it under persistence.
How can I detect a web shell?
Watch for unplanned new scripts in web folders and for the web server process starting command shells or unexpected utilities. MITRE points to process execution, file creation events and web server logs.
How do I defend against web shells?
Limit who can change web folders using least privilege, and consider disabling risky functions such as PHP's eval(). Regularly check for unexpected changes and turn off unneeded server features.
In our research
- Storm-3358 and ARTEX: How a Financial-Sector Intrusion Campaign Works November 2026
- Storm-2603 ToolShell Intrusion: The Fileless Chain Inside w3wp.exe, Step by Step November 2026
- Node.js Ecosystem Roundup: Node-RED Exploitation Reported, Cisco’s Brotli List and the 11 November Release November 2026
- VAPOR PANDA and ARTEX: How AI Agents Ran a China-Nexus Espionage Campaign October 2026
- KeyDrift: How a Cisco SD-WAN Vulnerability Became an IPsec Key Theft Tool October 2026
- CISA Adds Linux PHP2Shell Chain and VMware ESX Logging Issue to KEV October 2026
Sources
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 53 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 28 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 60 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 42 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 150 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 109 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.