Chisel
Chisel is an open-source TCP tunneling tool developed by Jamie Pillora that uses a client-server model to tunnel traffic over HTTP, including reverse tunnels and SOCKS5 proxying. Reporting in the provided content shows it is frequently repurposed by threat actors as a post-compromise utility for command-and-control, persistence, pivoting, and covert access into internal networks.
Observed malicious use cases in the content include reverse tunnels over HTTP, reverse SOCKS tunnels, layered persistence alongside web shells and GRE tunnels, and deployment on compromised hosts and network appliances. In Operation Escaneo, CloudSEK reported Chisel reverse tunnels used with Neo-reGeorg web shells and a compromised Cisco router with a GRE tunnel to maintain access, blend traffic into normal activity, and evade host-based defenses; logs recorded 3,708 Chisel sessions during a 13-day period. Huntress documented Chisel SOCKS tunnels and attempted reverse SOCKS tunnels during a May 2026 ClickFix intrusion, where operators used them alongside WinRM, WMIExec, SMBExec, a reverse shell on port 43301, and a renamed cloudflared binary for layered persistence after initial access via a malicious Run-dialog execution chain. Arctic Wolf reported the Lorenz ransomware group used Chisel after exploiting CVE-2022-29499 on a Mitel MiVoice Connect appliance, downloading the binary from GitHub, renaming it to "mem," and using it as a client to attacker infrastructure over HTTPS for tunneling and pivoting.
The content also ties Chisel to multiple threat actors and campaigns. It was observed in activity attributed to MuddyWater, including use of SharpChisel.exe to create reverse port forwarding and SOCKS5 access; in Twelve intrusions as part of a broader public-tool arsenal; in Stonefly/Andariel/APT45 financially motivated intrusions against U.S. organizations; in CERT-UA reporting on UAC-0247 attacks against Ukrainian municipal and healthcare entities where CHISEL and LIGOLO-NG were used for covert tunnels; in Cisco Talos reporting on UAT-9686 exploitation of Cisco AsyncOS CVE-2025-20393; in Fortinet reporting on a standalone FortiGate compromise case possibly linked to UNC757; in CISA/FBI reporting on Iran-linked Pioneer Kitten/UNC757 activity; and in Securonix CRON#TRAP, where a Go ELF binary named crondx was assessed as a customized Chisel client hard-coded to connect to 18.208.230[.]174 over WebSockets from a QEMU-based Tiny Core Linux guest.
Additional indicators and artifacts directly mentioned in the content include SharpChisel.exe; crondx; Chisel traffic over HTTP or WebSockets; Chisel server/client communications to 18.208.230[.]174, 213.165.41[.]26:22603, 77.110.122[.]58:24954, 137.184.181[.]252:8443, and 138.68.59[.]16:8443; and detection references such as "Potential Protocol Tunneling via Chisel Client." The content consistently characterizes Chisel as a dual-use tool rather than bespoke malware, but one that is widely used by intrusion operators for stealthy network tunneling, internal access, and persistence across Windows, Linux, and appliance environments.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The threat actor primarily gained initial access by compromising a Citrix NetScaler remote access server using a publicly available exploit for CVE-2019-19781.
Cisco revealed that a newly identified China-linked advanced persistent threat (APT), "UAT-9686," had been exploiting a zero-day vulnerability in Cisco email security appliances that run on its AsyncOS software. The vulnerability, tracked as CVE-2025-20393, has since been assigned a "critical" 10 out of 10 severity rating in the Common Vulnerability Scoring System (CVSS), and it has not yet been patched.
Groups observed using it
17 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Tooling including proprietary reconnaissance engine Kimera; a "curated exploit armory" targeting popular perimeter devices such as those from Fortinet, Ivanti, and Cisco; portable lateral movement toolkits; and "layered command-and-control infrastructure using Neo-reGeorg webshells, Chisel reverse tunnels, and compromised Cisco routers with persistent GRE tunnels," researchers said.
Tooling including proprietary reconnaissance engine Kimera; a "curated exploit armory" targeting popular perimeter devices such as those from Fortinet, Ivanti, and Cisco; portable lateral movement toolkits; and "layered command-and-control infrastructure using Neo-reGeorg webshells, Chisel reverse tunnels, and compromised Cisco routers with persistent GRE tunnels," researchers said.
Neo-reGeorg webshells gave encrypted footholds on web servers, Chisel reverse tunnels carried traffic over HTTP and a compromised Cisco router was fitted with a GRE tunnel pointing back to the attackers, a network-level channel invisible to host-based defenses.
Neo-reGeorg webshells gave encrypted footholds on web servers, Chisel reverse tunnels carried traffic over HTTP and a compromised Cisco router was fitted with a GRE tunnel pointing back to the attackers, a network-level channel invisible to host-based defenses.
The tools frequently used by the group include Cobalt Strike, mimikatz, chisel, BloodHound, PowerView, adPEAS, CrackMapExec, Advanced IP Scanner and PsExec.
Among the tunneling tools MuddyWater attackers were observed using are Chisel, SSF and Ligolo... In this case, the “SharpChisel.exe” client runs on the victim machine, connects back to the Chisel server over port 8080...
Techniques & procedures
26 distinct techniques documented for this family, organized by ATT&CK tactic.
Resource Development
1 technique
Resource Development
Initial Access
1 technique
Initial Access
Execution
3 techniques
Execution
On compromised servers, the binary drops as a hidden dot-prefixed file and persists at /var/tmp/.xs , using either a cron job or a systemd service to survive reboots.
Persistence
2 techniques
Persistence
Privilege Escalation
2 techniques
Privilege Escalation
Stealth
5 techniques
Stealth
Base64-encoded payloads including chisel.b64 , pwnkit_b64 , neo.jspx.b64 and payload.b64 ; chunked ELF binary delivery; AES-encrypted Neo-reGeorg webshell channel; custom Base64 alphabet.
The CMD365 and CMDEmber samples we observed masquerade as utility software, such as a PDF editor or browser, and as software that conducts update operations. The masquerading attempt involves the use of filenames, application icons, and digital signatures that indicate existing software vendors.
The name xsync resembles rsync and blends into typical Linux service listings.
A separate diagnostic script rounds out the toolkit. It selects five active beacons at random and runs a shell command on each to verify the presence of Chisel binaries at known drop paths, confirm a Chisel process is running, check available disk space, test reachability of port 9000 on the C2, and confirm persistence artifacts are still in place.
Defense Impairment
1 technique
Defense Impairment
Discovery
3 techniques
Discovery
Every 60 seconds it enumerates active Chisel tunnel ports via ss -tlnp, tests each new port for SMTP capability, and removes failed or dropped tunnels from the active pool.
The pgrep idempotency pattern changed from R:0.0.0.0:{port}:socks to R:.*:{port}:socks - a regex broadening that catches the tunnel regardless of bind address.
A separate diagnostic script rounds out the toolkit. It selects five active beacons at random and runs a shell command on each to verify the presence of Chisel binaries at known drop paths, confirm a Chisel process is running, check available disk space, test reachability of port 9000 on the C2, and confirm persistence artifacts are still in place.
Lateral Movement
2 techniques
Lateral Movement
Command and Control
8 techniques
Command and Control
The attacker used Sliver, an open-source command-and-control framework, combined with Chisel tunneling binaries compiled for most Linux CPU architectures: AMD64, ARM64, and x86.
CMDEmber sends and receives data from the C2 server by issuing HTTP POST and GET requests, respectively.
layered command-and-control infrastructure using Neo-reGeorg webshells, Chisel reverse tunnels, and compromised Cisco routers with persistent GRE tunnels
SOCKS5 pivot through 165.22.184.26:5571 to internal 10.39.x.x systems; Chisel reverse tunnel creating SOCKS proxies on 127.0.0.1:1080–1081; internal relay node at 10.39.1.204.
CloudSEK’s findings, as summarized by Infosecurity Magazine, describe Neo-reGeorg webshells, Chisel reverse tunnels, and even a compromised Cisco router configured with a GRE tunnel to maintain access. These methods helped the attackers stay connected while blending into normal traffic...
Layered architecture using a public VPS, SOCKS5 relay at 165.22.184.26, internal pivot and target subnet; per-target proxychains.conf routing.
That script downloaded and installed an MSI package in the background with no visible indication to the user. Separately, the attacker deployed EtherRAT... Five hours later, the attacker dropped EtherRAT and set up a Cloudflare tunnel using a renamed copy of cloudflared.
CloudSEK’s findings, as summarized by Infosecurity Magazine, describe Neo-reGeorg webshells, Chisel reverse tunnels, and even a compromised Cisco router configured with a GRE tunnel to maintain access. These methods helped the attackers stay connected while blending into normal traffic...
Exfiltration
1 technique
Exfiltration
IOCs tracked for this family
19 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
54 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A tunneling utility used for reverse tunnels to maintain attacker connectivity and evade detection by blending with normal traffic.
A reverse tunneling tool used to carry attacker traffic over HTTP and maintain covert connectivity into victim environments.
A reverse tunneling utility used in the campaign's command-and-control stack to maintain access and route traffic through compromised infrastructure.
A tunneling utility used by the attacker to create SOCKS tunnels and maintain layered persistence and network access during the intrusion.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.