Neo-reGeorg
Neo-reGeorg is a publicly available web shell and tunneling tool derived from reGeorg that is used to proxy traffic through a compromised web server into internal networks. The reporting consistently describes it as providing encrypted footholds on web servers and establishing SOCKS5 proxying for webshell-based pivoting; it can create multiple TCP connections for a single session. Mentioned variants include JSPX/JSP web shells with AES-encrypted channels and custom Base64 encoding, and reporting also references ASPX, PHP, Go, and ASHX variants. It has been observed deployed on compromised internet-facing servers and web applications, including IIS and Exchange-related infrastructure, to maintain persistent access and tunnel attacker traffic over HTTP.
The tool appears across multiple intrusion sets and campaigns. CloudSEK reported Neo-reGeorg as part of Operation Escaneo, attributed with medium confidence to MexicanMafia/PanchoVilla, where it was used alongside Chisel reverse tunnels and compromised Cisco routers with GRE tunnels for layered command-and-control and persistence against government, financial, and critical infrastructure organizations in Latin America, especially Mexico, with additional activity in Ecuador and Portugal. Kaspersky reported APT41 using a Neo-reGeorg tunnel on a compromised IIS server in an intrusion against African government IT services. Ctrl-Alt-Intel and related reporting described MuddyWater using Neo-reGeorg for webshell-based SOCKS pivoting, including deployment of nfud.aspx on a Portuguese government-related Exchange server. During the 2022 Ukraine Electric Power Attack, Sandworm Team deployed the Neo-REGEORG web shell on an internet-facing server. Unit 42 also listed Neo-reGeorg among the web shells used by TGR-STA-1030/UNC6619 in global espionage operations, and CrowdStrike reported Murky Panda/Silk Typhoon deploying Neo-reGeorg for persistence.
Observed behaviors and use cases in the content include persistent web access, encrypted tunneling, SOCKS pivoting from external to internal networks, and support for layered C2 architectures. One cited active deployment was https://mail.sef.pt/aspnet_client/system_web/4_0_30319/nfud.aspx, and one recovered tunnel key was 123QWEasd. Cisco Talos also noted a PHP web shell named 401.php based on the publicly available Neo-reGeorg codebase. High-confidence associations in the content include use by APT41, MuddyWater, Sandworm Team, Murky Panda/Silk Typhoon, TGR-STA-1030/UNC6619, and the Operation Escaneo activity cluster.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Other infection pathways include exploitation of known security flaws in Citrix NetScaler ADC and NetScaler Gateway (CVE-2023-3519) and Commvault (CVE-2025-3928).
Other infection pathways include exploitation of known security flaws in Citrix NetScaler ADC and NetScaler Gateway (CVE-2023-3519) and Commvault (CVE-2025-3928).
Groups observed using it
10 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Tooling including proprietary reconnaissance engine Kimera; a "curated exploit armory" targeting popular perimeter devices such as those from Fortinet, Ivanti, and Cisco; portable lateral movement toolkits; and "layered command-and-control infrastructure using Neo-reGeorg webshells, Chisel reverse tunnels, and compromised Cisco routers with persistent GRE tunnels," researchers said.
Tooling including proprietary reconnaissance engine Kimera; a "curated exploit armory" targeting popular perimeter devices such as those from Fortinet, Ivanti, and Cisco; portable lateral movement toolkits; and "layered command-and-control infrastructure using Neo-reGeorg webshells, Chisel reverse tunnels, and compromised Cisco routers with persistent GRE tunnels," researchers said.
Neo-reGeorg webshells gave encrypted footholds on web servers, Chisel reverse tunnels carried traffic over HTTP and a compromised Cisco router was fitted with a GRE tunnel pointing back to the attackers, a network-level channel invisible to host-based defenses.
Neo-reGeorg webshells gave encrypted footholds on web servers, Chisel reverse tunnels carried traffic over HTTP and a compromised Cisco router was fitted with a GRE tunnel pointing back to the attackers, a network-level channel invisible to host-based defenses.
Based on these names, we were able to determine that this instance utilized a Neo-reGeorg web shell tunnel. This tool is used to proxy traffic from an external network to an internal one via an externally accessible web server.
MuddyWater was observed leveraging the Chinese-developed tool Neo-reGeorg to perform webshell-based SOCKS pivoting.
Techniques & procedures
19 distinct techniques documented for this family, organized by ATT&CK tactic.
Resource Development
1 technique
Resource Development
Initial Access
1 technique
Initial Access
Persistence
2 techniques
Persistence
Stealth
1 technique
Stealth
Discovery
1 technique
Discovery
Lateral Movement
2 techniques
Lateral Movement
Command and Control
10 techniques
Command and Control
AES-encrypted Neo-reGeorg channel key; GZIP-compressed inner payload loaded through reflection with an obfuscated defineClass invocation.
Neo-reGeorg HTTP POST BLV-encoded C2 channel; reverse shells on ports 80, 443 and 8080 to blend with HTTP and HTTPS traffic; Wget-based callback beacons.
layered command-and-control infrastructure using Neo-reGeorg webshells, Chisel reverse tunnels, and compromised Cisco routers with persistent GRE tunnels
SOCKS5 pivot through 165.22.184.26:5571 to internal 10.39.x.x systems; Chisel reverse tunnel creating SOCKS proxies on 127.0.0.1:1080–1081; internal relay node at 10.39.1.204.
CloudSEK’s findings, as summarized by Infosecurity Magazine, describe Neo-reGeorg webshells, Chisel reverse tunnels, and even a compromised Cisco router configured with a GRE tunnel to maintain access. These methods helped the attackers stay connected while blending into normal traffic...
Layered architecture using a public VPS, SOCKS5 relay at 165.22.184.26, internal pivot and target subnet; per-target proxychains.conf routing.
Aria-body has the ability to use a reverse SOCKS proxy module... BADHATCH can use SOCKS4 and SOCKS5 proxies... GoBear implements SOCKS5 proxy functionality... Neo-reGeorg has the ability to establish a SOCKS5 proxy... Remcos uses the infected hosts as SOCKS5 proxies...
The attackers then started dropping various samples on this server, notably a dropper that was pushing more compiled variants carrying the same functionality... The attackers tried to drop additional post-exploitation tools to achieve their main objectives.
IOCs tracked for this family
5 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
22 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A webshell used to maintain persistence and control within compromised environments, enabling continued attacker access while blending into normal traffic.
A webshell used to establish encrypted footholds on compromised web servers for persistent access.
A webshell/tunneling tool used as part of layered command-and-control infrastructure in Operation Escaneo to support persistence and covert access.
An HTTP-tunneled SOCKS5 webshell framework used for persistence, proxying, internal SMB probing, and command-and-control over AES-encrypted and custom-encoded channels.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.