China Chopper
- ID
- S0020
- Type
- Malware
- Platforms
- Windows
- Source
- attack.mitre.org
- MITRE last modified
- 4 Jan 2024
China Chopper is a Web Shell hosted on Web servers to provide access back into an enterprise network that does not rely on an infected system calling back to a remote command and control server.[1] It has been used by several threat groups.[2][3][4][5]
Techniques used (10)
- T1005 Data from Local System
- T1027.002 Software Packing
- T1046 Network Service Discovery
- T1059.003 Windows Command Shell
- T1070.006 Timestomp
- T1071.001 Web Protocols
- T1083 File and Directory Discovery
- T1105 Ingress Tool Transfer
- T1110.001 Password Guessing
- T1505.003 Web Shell
Groups using it (9)
- G0027 Threat Group-3390
- G0065 Leviathan
- G0093 GALLIUM
- G0096 APT41
- G0117 Fox Kitten
- G0125 HAFNIUM
- G0129 Mustang Panda
- G0135 BackdoorDiplomacy
- G1022 ToddyCat