BEHINDER
Behinder, also known as Rebeyond, Ice Scorpion, and 冰蝎, is a cross-platform web shell used to provide persistent remote access on compromised web servers. The content states it is designed to work with PHP, Java/JSP, and ASP.NET environments and supports encrypted operator communications, including AES-encrypted communications; one observed modified variant used Base64 instead of the AES encryption commonly seen in other variants. Behinder is described as modular, with plugin or module-based post-exploitation capabilities, and has been associated with modules and components such as BShell.dll, BasicInfo.dll, Cmd.dll, Database.dll, Echo.dll, Eval.dll, FileOperation.dll, Hs.dll, LoadNativeLibrary.dll, Loader.dll, Plugin.dll, PortMap.dll, RealCMD.dll, RemoteSocksProxy.dll, ReversePortMap.dll, SocksProxy.dll, Transfer.dll, and Utils.dll. Distinctive in-memory indicators linked to Behinder included the method names EnjsonAndCrypt and getExtraData and a repeated 0x7E byte array.
Across the provided reporting, Behinder was deployed after exploitation of internet-facing applications and appliances, including Atlassian Confluence, Ivanti Endpoint Manager Mobile (EPMM), Cisco Catalyst SD-WAN Manager/Controller, Trimble Cityworks, SharePoint/IIS environments, and Ivanti CSA. Observed deployments included JSP web shells such as conf.jsp, sysinit.jsp, and web shells dropped under paths like /mi/tomcat/webapps/mifs/, with Ivanti EPMM cases also noting filenames 401.jsp, 403.jsp, and 1.jsp and a Behinder variant deployed as conf.jsp on Cisco SD-WAN. In Confluence exploitation, Volexity observed attackers install BEHINDER as a JSP web shell and then use it to deploy China Chopper and a file upload tool. In Cisco Talos reporting on Trimble Cityworks exploitation, Behinder was one of several IIS web shells rapidly deployed after CVE-2025-0994 exploitation. In Cisco SD-WAN exploitation clusters active from March 2026, Behinder and modified Behinder variants were deployed by multiple clusters following exploitation of CVE-2026-20133, CVE-2026-20128, and CVE-2026-20122.
The malware is repeatedly associated in the content with Chinese-speaking or China-nexus activity. Reporting links its use to Chinese-language tooling or documentation, Chinese-language messages in deployed web shells and uploaders, UTC+8 operational alignment, and campaigns assessed as Chinese-speaking, PRC-nexus, or China state-aligned. Threat actors and clusters mentioned using Behinder include UAT-6382, APT15, UNC5174/Houken, TGR-STA-1030/UNC6619, and multiple Cisco SD-WAN exploitation clusters; Volexity also assessed multiple threat actors from China were exploiting Confluence and installing BEHINDER. The content also notes Behinder is publicly available, including on GitHub, and that Chinese-language tutorials have made it broadly accessible.
Behinder has been used against government, critical infrastructure, municipal, healthcare, manufacturing, legal, high-tech, telecommunications, finance, media, transport, education, and foreign affairs targets, depending on the campaign. Its role in the cited intrusions was to provide remote command execution, backdoor access, persistence, and follow-on post-exploitation support alongside tools such as Godzilla, Neo-reGeorg, AntSword, China Chopper, VShell, Sliver, Cobalt Strike, GOST, FRPS, IOX, and GOREVERSE.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
11 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
CVE-2026-1281 + CVE-2026-1340: pre-auth RCE через bash arithmetic expansion... Обе - code injection, позволяющий неаутентифицированному атакующему выполнить произвольный код. | Hadrian отмечает среди используемых Behinder - Java web shell с шифрованным каналом связи.
CVE-2026-1281 + CVE-2026-1340: pre-auth RCE через bash arithmetic expansion... Обе - code injection, позволяющий неаутентифицированному атакующему выполнить произвольный код... Unit 42 фиксирует: до момента публикации 29 января 2026 уже шла активная эксплуатация. | Hadrian отмечает среди используемых Behinder - Java web shell с шифрованным каналом связи.
Cisco Talos has observed exploitation of CVE-2025-0994, a remote-code-execution vulnerability in Cityworks, a popular asset management system. The Cybersecurity and Infrastructure Security Agency (CISA) and Trimble have both released advisories pertaining to this vulnerability... | These web shells consisted of multiple variations of AntSword, chinatso and Behinder along with additional generic file uploaders containing messages written in the Chinese language.
Talos has found intrusions in enterprise networks of local governing bodies in the United States (U.S.), beginning January 2025 when initial exploitation first took place. UAT-6382 successfully exploited CVE-2025-0944, conducted reconnaissance and rapidly deployed a variety of web shells and custom-made malware to maintain long-term access.
Following their exploitation, the threat actor deployed a variant of the Behinder webshell under the filename “conf.jsp”.
Following their exploitation, the threat actor deployed a variant of the Behinder webshell under the filename “conf.jsp”.
Following their exploitation, the threat actor deployed a variant of the Behinder webshell under the filename “conf.jsp”.
In the breach analyzed by Volexity, threat actors installed BEHINDER, a JSP web shell that allows threat actors to execute commands on the compromised server remotely.
Mandiant disclosed the vulnerability CVE-2021-20023 to SonicWall PSIRT on April 6, 2021... a patch became available April 19. To mitigate the three CVEs, Mandiant and SonicWall recommend upgrading Email Security to version 10.0.9.6173 (Windows) or 10.0.9.6177 (Hardware & ESXi Virtual Appliances).
Mandiant disclosed the vulnerabilities CVE-2021-20021 and CVE-2021-20022 to SonicWall PSIRT on March 26, 2021... a hotfix became available on April 9, 2021... To mitigate the three CVEs, Mandiant and SonicWall recommend upgrading Email Security to version 10.0.9.6173 (Windows) or 10.0.9.6177 (Hardware & ESXi Virtual Appliances).
SonicWall has deployed Intrusion Prevention System (IPS) signatures... IPS Signature : 15520 WEB-ATTACKS SonicWall Email Security (CVE-2021-20022 Vulnerability) ... Mandiant disclosed the vulnerabilities CVE-2021-20021 and CVE-2021-20022... a hotfix became available on April 9, 2021.
Groups observed using it
6 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
These web shells consisted of multiple variations of AntSword, chinatso and Behinder along with additional generic file uploaders containing messages written in the Chinese language.
Use of Chinese-documented tooling (e.g., Behinder, VShell), and operational activity aligned with China Standard Time (UTC+8).
Web shells – AntSword, Behinder, China Chopper, Godzilla , giving the hackers backdoor access to the breached systems.
"...includes webshells such as Behinder, Godzilla, and Neo-reGeorg..."
FireEye Malware File Scanning ... FE_Webshell_JSP_BEHINDER_1 ... Webshell.JSP.BEHINDER ... Webshell.JSP.BEHINDER.MVX
Techniques & procedures
11 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 technique
Initial Access
Execution
2 techniques
Execution
Persistence
1 technique
Persistence
Stealth
2 techniques
Stealth
Lateral Movement
1 technique
Lateral Movement
Talos is also aware of the widespread in-the-wild active exploitation of three vulnerabilities in unpatched Cisco Catalyst SD-WAN Manager infrastructure (CVE-2026-20133, CVE-2026-20128, and CVE-2026-20122) that, when chained together, can allow a remote unauthenticated attacker to gain access to the device.
Collection
1 technique
Collection
IOCs tracked for this family
12 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
17 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Java web shell with encrypted communications used for persistence and remote control after Ivanti EPMM compromise.
A web shell deployed by multiple clusters on hacked Cisco SD-WAN systems.
A webshell used by threat clusters after exploiting Cisco SD-WAN vulnerabilities.
A JSP webshell used after exploitation of Cisco SD-WAN vulnerabilities; one observed variant was modified to use only Base64 encoding instead of the AES encryption commonly seen in other variants.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.