Loading malware…
Behinder, also known as Ice Scorpion, Rebeyond, and 冰蝎, is a publicly available cross-platform web shell framework widely used for post-exploitation on web servers. It supports server-side payloads for PHP, Java/JSP, ASP, ASP.NET, and C#, with a Java-based client used to manage compromised systems. Behinder is designed to provide encrypted operator-to-shell communications and modular remote administration capabilities, including command execution, file management, and in-memory payload loading. It has also been associated with memory-resident variants that dynamically load attacker-supplied bytecode into server processes, particularly in Java environments such as Apache Tomcat, enabling stealthier persistence and execution without writing full payloads to disk.
Java-focused Behinder variants and related memory shells commonly use reflection and dynamic class loading to define malicious classes directly in memory, often masquerading as servlet filters or similar application components. Observed samples decrypt attacker-supplied content, decode embedded or transmitted bytecode, and instantiate classes in memory to execute follow-on functionality. Some variants gate execution on specific HTTP header values and use AES-protected request bodies or Base64-wrapped payloads. Obfuscation and evasion techniques seen with Behinder deployments include layered encoding, Unicode-based source obfuscation, and commercial Java obfuscators to hinder analysis and bypass web application firewalls.
Behinder has been repeatedly observed in real-world intrusions following exploitation of internet-facing systems, including VPN appliances, email security products, web applications, and enterprise management platforms. It has been used by multiple threat clusters rather than a single actor, including China-nexus activity and opportunistic post-exploitation operators. Reported incidents have involved deployment on compromised SonicWall, Ivanti, Cisco SD-WAN, IIS, Exchange, SharePoint, and Tomcat-backed environments. In several campaigns, Behinder served as a foothold for credential theft, lateral movement, access to emails and files, and broader post-compromise operations.
The framework is notable for its plugin-style ecosystem and support for extended capabilities such as in-memory shell injection, proxying, and integration with other offensive tooling. Its prevalence, multi-language support, encrypted communications, and memory-resident tradecraft have made it one of the most recognizable and frequently encountered web shell families in enterprise intrusion investigations.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
12 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Mandiant and Palo Alto’s Unit42 have also reported on Behinder and Godzilla web shells deployed upon initial access in high-profile intrusions such as SonicWall, and ProxyShell. | Also referred to as Ice Scorpion, Behinder is publicly available and maintained by GitHub user rebeyond.
CVE-2026-1281 + CVE-2026-1340: pre-auth RCE через bash arithmetic expansion... Обе - code injection, позволяющий неаутентифицированному атакующему выполнить произвольный код. | Hadrian отмечает среди используемых Behinder - Java web shell с шифрованным каналом связи.
CVE-2026-1281 + CVE-2026-1340: pre-auth RCE через bash arithmetic expansion... Обе - code injection, позволяющий неаутентифицированному атакующему выполнить произвольный код... Unit 42 фиксирует: до момента публикации 29 января 2026 уже шла активная эксплуатация. | Hadrian отмечает среди используемых Behinder - Java web shell с шифрованным каналом связи.
Cisco Talos has observed exploitation of CVE-2025-0994, a remote-code-execution vulnerability in Cityworks, a popular asset management system. The Cybersecurity and Infrastructure Security Agency (CISA) and Trimble have both released advisories pertaining to this vulnerability... | These web shells consisted of multiple variations of AntSword, chinatso and Behinder along with additional generic file uploaders containing messages written in the Chinese language.
Talos has found intrusions in enterprise networks of local governing bodies in the United States (U.S.), beginning January 2025 when initial exploitation first took place. UAT-6382 successfully exploited CVE-2025-0944, conducted reconnaissance and rapidly deployed a variety of web shells and custom-made malware to maintain long-term access.
Following their exploitation, the threat actor deployed a variant of the Behinder webshell under the filename “conf.jsp”.
Following their exploitation, the threat actor deployed a variant of the Behinder webshell under the filename “conf.jsp”.
Following their exploitation, the threat actor deployed a variant of the Behinder webshell under the filename “conf.jsp”.
In the breach analyzed by Volexity, threat actors installed BEHINDER, a JSP web shell that allows threat actors to execute commands on the compromised server remotely.
Mandiant disclosed the vulnerability CVE-2021-20023 to SonicWall PSIRT on April 6, 2021... a patch became available April 19. To mitigate the three CVEs, Mandiant and SonicWall recommend upgrading Email Security to version 10.0.9.6173 (Windows) or 10.0.9.6177 (Hardware & ESXi Virtual Appliances).
Mandiant disclosed the vulnerabilities CVE-2021-20021 and CVE-2021-20022 to SonicWall PSIRT on March 26, 2021... a hotfix became available on April 9, 2021... To mitigate the three CVEs, Mandiant and SonicWall recommend upgrading Email Security to version 10.0.9.6173 (Windows) or 10.0.9.6177 (Hardware & ESXi Virtual Appliances).
SonicWall has deployed Intrusion Prevention System (IPS) signatures... IPS Signature : 15520 WEB-ATTACKS SonicWall Email Security (CVE-2021-20022 Vulnerability) ... Mandiant disclosed the vulnerabilities CVE-2021-20021 and CVE-2021-20022... a hotfix became available on April 9, 2021.
6 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
On some of the compromised Ivanti CSA appliances investigated, webshells related to the open-source tool Neo-reGeorg or generated via the Behinder (“Ice Scorpion”) webshell framework were found.
These three zero-days were also actively exploited by a group Mandiant tracks as UNC2682 to backdoor systems using BEHINDER web shells, allowing them to move laterally through victims' networks and access emails and files.
These web shells consisted of multiple variations of AntSword, chinatso and Behinder along with additional generic file uploaders containing messages written in the Chinese language.
Web shells – AntSword, Behinder, China Chopper, Godzilla , giving the hackers backdoor access to the breached systems.
"...includes webshells such as Behinder, Godzilla, and Neo-reGeorg..."
21 distinct techniques documented for this family, organized by ATT&CK tactic.
The China Chopper web shell has long been utilized post exploit to blend in network traffic, providing the attacker full command prompt access to move around the network.
<%\u0074\u0072\uuu0079 {\uuu000a\uuu0020 \uuu0020 C\u006cas\u0073\uuu004co\u0061d\uu0065\uu0072 ... | 整个内存马过Waf的处理流程如下 冰蝎内存马-->ZKM15混淆-->class文件输出为Base64文件-->ZKM15混淆-->class文件输出为Base64文件-->特殊Unicode编码 | The sample is heavily encoded/obfuscated with escaped Unicode sequences and a large embedded Base64-like blob.
final Cipher instance = Cipher . getInstance ( "AES" ); instance . init ( 2 , new SecretKeySpec ((( String ) httpServletRequest . getSession (). getAttribute ( "u" )). getBytes (), "AES" ));
What caught my eye was the in-memory web shell referred to as MemShell... The try block in Figure 7 implements MemShell
This type of webshell is widely used... by dynamically loading Java bytecode directly into memory instead of storing it on disk.
java . lang . reflect . Method defineClzMethod = clzLoader . loadClass ( "java.lang.ClassLoader" ). getDeclaredMethod ( "defineClass" , String . class , byte []. class , int . class , int . class ); defineClzMethod . setAccessible ( true ); Class clz = ( Class ) defineClzMethod . invoke ( clzLoader , clzName , bytecode , 0 , bytecode . length ); clz . newInstance ();
Talos is also aware of the widespread in-the-wild active exploitation of three vulnerabilities in unpatched Cisco Catalyst SD-WAN Manager infrastructure (CVE-2026-20133, CVE-2026-20128, and CVE-2026-20122) that, when chained together, can allow a remote unauthenticated attacker to gain access to the device.
if ( httpServletRequest . getHeader ( "User-Agent" ) != null && httpServletRequest . getHeader ( "User-Agent" ). equals ( "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.26 (KHTML, like Gecko) Chrome/86.0.4240.138 Safari/531.26" ))
Figure 11: Packet capture of POST requests over port 80 Figure 12: Behinder HTTP POST request with encoded data in HTTP body
12 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
29 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as the model/comparison point for ORANGETAIL; not the malware primarily deployed in this incident.
A known webshell mentioned only as a comparison point for ORANGETAIL’s functionality and design.
A web shell framework referenced as the model for ORANGETAIL; mentioned for comparison rather than as the primary malware deployed in this incident.
Referenced as the model for ORANGETAIL's webshell design.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.