b374k

b374k is a publicly available PHP webshell used for persistent remote administration of compromised web servers. It is typically deployed after an attacker has already obtained code execution on a target, allowing continued access through a browser-based management interface. The tool has been observed on exposed command-and-control and staging infrastructure and is also commonly referenced in defensive signatures and shell-finder tooling because of its widespread criminal and intrusion-set use.

As a webshell, b374k provides post-compromise control of the underlying server and commonly supports file management, command execution, upload of additional payloads, and broader remote administration functions. Its role is primarily post-exploitation and persistence on web-accessible systems rather than initial compromise. Reporting has linked its operational use to North Korea-linked activity, including Kimsuky infrastructure management, but the malware is commodity and publicly available, so its presence alone is not sufficient for attribution.

b374k has also been observed as a follow-on payload after exploitation of vulnerable web applications, including cases where attackers abused server-side flaws to upload persistent PHP webshells. It targets PHP-capable web environments and therefore most directly affects Linux or Windows web servers running PHP applications. Because it is a server-side webshell rather than an endpoint implant, it is best characterized as a web-based backdoor used to maintain unauthorized access, execute commands, and facilitate further malicious activity on compromised hosts.