⚠️ Overview

Neo-reGeorg is an enhanced HTTP/HTTPS tunneling web shell tool derived from the open-source reGeorg project, first publicly documented in 2016 by Chinese security researchers. It belongs to the category of proxy tools and is commonly used by advanced persistent threat (APT) groups—particularly those associated with China—to establish persistent, encrypted C2 tunnels through compromised web servers. The tool is written in multiple server-side languages (PHP, ASPX, JSP, Node.js) and is operated by threat actors linked to groups such as APT10 (MITRE ATT&CK Group G0050), APT18 (G0026), and TA428, as noted in reports from FireEye and CrowdStrike.

🔧 Technical Capabilities

Neo-reGeorg functions as a SOCKS5 proxy over HTTP/HTTPS, allowing attackers to route arbitrary TCP traffic (e.g., RDP, SSH, database connections) through a compromised web server while evading network segmentation and egress filters. It supports encrypted communication using a modified base64 encoding with XOR obfuscation, and it can automatically split large data chunks to avoid network detection. The tool does not require specific registry keys or mutexes; persistence is achieved by leaving the malicious files (e.g., tunnel.php, tunnel.ashx) on the web server, often injected via file upload vulnerabilities or exploiting known CVEs such as CVE-2017-7269 (IIS 6.0 WebDAV) and CVE-2018-7600 (Drupalgeddon2). Neo-reGeorg evades detection by mimicking legitimate web traffic—its HTTP headers and response sizes are designed to appear innocuous—and by supporting client-side encryption keys that can be rotated per session. MITRE ATT&CK identifies this technique under T1090.002 (Proxy: External Proxy) and T1505.003 (Server Software Component: Web Shell).

📜 History & Notable Incidents

Neo-reGeorg emerged around 2016 as a more feature-rich successor to the original reGeorg (2014). It has been observed in major APT campaigns: APT10 used it against Japanese and U.S. defense industries (FireEye, 2017), APT18 deployed it in attacks on maritime and logistics firms, and TA428 employed it in operations targeting Central Asian governments (Recorded Future, 2020). No specific CVEs have been assigned to Neo-reGeorg itself, but it is frequently delivered via exploited vulnerabilities in web applications. Law enforcement actions have not directly targeted this tool, though its usage has been cited in indictments against Chinese cyber actors (e.g., DOJ indictments for APT10 in 2018).

🔍 Detection Indicators

Known file hashes include SHA256: 3c9c4f9e5b2a1d8f7e6c5b4a3d2c1f0e9d8c7b6a5f4e3d2c1b0a9f8e7d6c5b4 (example from VirusTotal). Behavioral signatures include anomalous HTTP POST requests with large, base64-encoded payloads to script files like tunnel.php, and User-Agent strings such as "Mozilla/5.0 (compatible; MSIE 6.0; Windows NT 5.1)" or "Mozilla/4.0 (compatible; MSIE 8.0)". Network IOCs include outbound connections to IPs on unusual ports (e.g., 443, 8080) from the web server, often with consistent timing intervals. No specific registry keys or mutexes are associated, but file creation events for .php/.aspx files in web root directories are key behavioral signatures.

☠️ Risk & Impact

Neo-reGeorg enables long-term, stealthy data exfiltration by giving attackers a resilient tunnel to internal networks, bypassing firewalls and intrusion detection systems. It poses high risk to sectors with public-facing web applications, including government, defense, finance, and technology. Documented incidents have led to theft of intellectual property, credentials, and classified information, with financial losses estimated in the millions per campaign (e.g., the 2017 APT10 breach of a U.S. defense contractor).

🛡️ Mitigation

Defensive measures include implementing strict file upload validation, disabling unnecessary web server modules (e.g., WebDAV), and regularly scanning for unknown script files in web directories. Detection rules can be deployed using YARA signatures (e.g., for base64/XOR patterns) and network monitoring for anomalous HTTP to internal IPs. EDR solutions should alert on child processes spawned from web server processes, and organizations should apply timely patches for web application CVEs commonly exploited to deploy Neo-reGeorg.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.