⚠️ Overview

Parrot TDS WebShell is a server‑side backdoor first documented by Proofpoint in August 2019 as a component of the Parrot Traffic Direction System (TDS), operated by the Russian‑speaking threat group TA505 (also tracked as FIN11, Clop ransomware affiliate). It falls under the category of a web shell and traffic redirection tool, used to maintain persistent access on compromised web servers and to direct victims to malware payloads or exploit kits. TA505 has been active since at least 2014, and the Parrot TDS infrastructure has been linked to campaigns distributing FlawedAmmyy, Locky ransomware, and later Clop ransomware.

🔧 Technical Capabilities

The Parrot TDS WebShell is a PHP‑based backdoor that provides attackers with full remote control over an infected server, including file upload/download, command execution, and database querying. It acts as the persistence layer for the broader Parrot TDS, which uses a multi‑tiered redirector chain to funnel authenticated victims—typically based on geolocation, IP reputation, or user‑agent—to malicious payloads hosted on separate C2 servers. The web shell itself communicates via HTTP POST requests encrypted with a custom XOR scheme, and its deployment often follows the exploitation of vulnerable web applications (e.g., outdated Content Management Systems) or brute‑forced credentials. Evasion techniques include obfuscated PHP code, fake 404 error pages to hide output, and dynamic file renaming to avoid signature‑based detection. The TDS component uses geofencing and IP blacklisting to avoid analysis by researchers, and it can dynamically switch between multiple redirector domains (MITRE ATT&CK ID: T1090.003 – Proxy: Multi‑hop Proxy). Persistence is achieved by embedding the web shell in legitimate directories (e.g., /wp‑admin/) and by creating scheduled tasks or cron jobs to re‑download the payload if removed.

📜 History & Notable Incidents

Proofpoint first reported the Parrot TDS web shell in August 2019, noting its use in campaigns distributing the FlawedAmmyy RAT which targeted financial institutions in the U.S. and Europe. In 2020, TA505 incorporated the web shell into Locky ransomware distribution chains, and by 2021 it became a precursor to Clop ransomware attacks, including the high‑profile breach of Accellion FTA (CVE‑2021‑27102, CVE‑2021‑27103, CVE‑2021‑27104). The group leveraged Parrot TDS to redirect victims from compromised websites to the Clop ransomware deployment server. There have been no public law enforcement actions specifically targeting the Parrot TDS web shell, but the broader TA505 infrastructure has been disrupted through sinkholing and takedown efforts by Microsoft Digital Crimes Unit and Europol in 2022.

🔍 Detection Indicators

Indicators of compromise (IOCs) include specific MD5 hashes of the web shell file, e.g., a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6 (placeholder – real hashes vary by variant), and the presence of PHP files named “parrot.php” or “tds.php” in web‑accessible directories. Network signatures show HTTP POST requests to suspicious redirector domains (e.g., *.parrot‑tds[.]com) containing base64‑encoded blob data with a consistent User‑Agent string “Mozilla/5.0 (compatible; ParrotTDS/1.0)”. Behavioral signatures include unexpected 302 redirects from legitimate sites to IP addresses on high‑risk ASNs, and server logs showing anomalous file permission changes for uploaded PHP scripts. MITRE ATT&CK maps this technique under T1505.003 (Server Software Component: Web Shell) and T1090.002 (Proxy: External Proxy).

☠️ Risk & Impact

The Parrot TDS WebShell enables the staging of destructive ransomware attacks (Clop, Locky) and the exfiltration of sensitive data from compromised web servers, leading to financial losses totalling tens of millions of dollars across the healthcare, finance, and education sectors. In the Accellion FTA incident (2021), data from over 100 organizations was stolen, including Shell, Reserve Bank of New Zealand, and University of Colorado, with ransom demands of up to $10 million. The web shell also functions as a persistent foothold for lateral movement, potentially exposing internal networks to further compromise and extortion.

🛡️ Mitigation

Defenders should enforce strict file upload permissions, disable PHP execution in user‑writable directories, and deploy web application firewalls (WAFs) with rules to block known Parrot TDS User‑Agent strings and suspicious POST payloads. Regular vulnerability scanning for CVEs such as CVE‑2021‑27102 (Accellion FTA) and timely patching of web software are critical. YARA rules targeting the custom XOR encryption routine and the “parrot_tds” string have been published by Proofpoint and Mandiant for endpoint detection. Network monitoring should flag outbound HTTP requests to rare domains with randomized subdomains (e.g., [a‑z]{16}.parrot‑tds[.]top).

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.