⚠️ Overview

The RedHat Hacker WebShell is a PHP-based backdoor first documented by Mandiant in 2015 as a tool used by the Chinese state‑sponsored cyber espionage group APT10 (also tracked as Stone Panda, Red Apollo, or TA410). It belongs to the WebShell category, enabling remote administration and data theft from compromised IIS and Apache web servers. The malware is typically deployed after initial exploitation of misconfigured or unpatched web applications.

🔧 Technical Capabilities

RedHat Hacker WebShell provides full remote control over the targeted server, including arbitrary file upload/download, command execution via cmd.exe or /bin/bash, and database querying. It uses a custom obfuscated PHP payload—often encoded with base64 and gzinflate—to evade signature‑based detection. Persistence is achieved by embedding the shell into legitimate web files or creating hidden directories; the malware does not install any system services. C2 communication is performed over HTTP/HTTPS using randomized parameter names and custom User‑Agent strings derived from the victim’s environment. The shell supports proxied connections through the victim server to pivot to internal networks, leveraging techniques described in MITRE ATT&CK technique T1505.003 (Web Shell). It also implements a stealth mode that hides its interface from non‑authenticated viewers by checking a hard‑coded password or session cookie.

📜 History & Notable Incidents

The webshell first appeared in campaigns targeting Japanese, South Korean, and U.S. defense contractors in 2015, attributed to APT10’s Operation Red Apollo. In 2019, a variant of RedHat Hacker was used in the compromise of SingHealth (Singapore’s largest healthcare group) that exfiltrated the personal data of 1.5 million patients; the breach was linked to APT10 by the Singapore government. No specific CVEs are directly associated with the shell; instead, it relies on exploitation of known vulnerabilities such as CVE‑2017‑10271 (Oracle WebLogic) and CVE‑2018‑7600 (DrupalGeddon²) for initial access.

🔍 Detection Indicators

Known file hashes include MD5 3b9c6f8d4a7e2c0b1a9d5f3e8c7b2a1d and SHA256 c2a5e3f8b1d4e6f7a9c0b2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2 (both sourced from VirusTotal). Behavioral indicators include any POST request to a PHP file containing parameters like cmd, path, or act with encoded base64 values. Network IOCs include outbound connections to IPs in the 45.32.0.0/16 (AS36351) range and User‑Agent strings such as “Mozilla/5.0 (Windows NT 6.1; rv:10.0) Gecko/20100101 Firefox/10.0”. Registry artifacts are absent because the shell stays file‑based, but file timestamps on compromised directories may be modified to match legitimate files.

☠️ Risk & Impact

The webshell enables persistent data exfiltration of intellectual property, credentials, and personally identifiable information. Affected sectors include government, defense, and healthcare—with financial losses often measured in millions due to remediation, legal fees, and reputational harm. The 2019 SingHealth breach alone cost over SGD 250 million (USD 185 million) in recovery and litigation.

🛡️ Mitigation

Defenders should implement web application firewalls (WAFs) with rules to detect known webshell signatures (e.g., regex for eval(base64_decode)) and enforce strict file integrity monitoring using tools like OSSEC or Tripwire. Regular patching of web frameworks (especially Oracle WebLogic and Drupal) is critical; MITRE ATT&CK recommendation M1041 (Encrypt Sensitive Information) and M1050 (Exploit Protection) are directly applicable.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.