C99

C99 is a well-known PHP webshell family that became widely used in the early and mid-2000s as a post-exploitation implant on compromised web servers. It is typically deployed after attackers obtain the ability to upload or write server-side code through vulnerabilities, stolen credentials, or administrative abuse. Once installed, it provides a browser-accessible interface for remote command execution and broader control of the hosting environment.

C99 is associated with classic webshell tradecraft on PHP-based servers and is commonly grouped with other prominent families such as r57, WSO, and c66. Variants and derivatives have appeared in many public malware collections and detection rule sets, reflecting long-term reuse, modification, and repackaging by multiple threat actors rather than exclusive use by a single group.

Its functionality commonly includes command execution, file browsing and manipulation, file upload, and general server administration features that support follow-on intrusion activity. In operational use, such capabilities enable attackers to maintain persistence on a compromised web application server, conduct reconnaissance of the local environment, stage additional payloads, and perform post-exploitation actions. Webshells in this class are also routinely used to facilitate data theft and, depending on the surrounding environment and privileges, can support lateral movement or privilege escalation through native system tools and misconfigurations.

C99 primarily targets and runs on PHP-enabled web servers, most commonly in Linux hosting environments, though the decisive platform characteristic is the presence of a PHP-capable web stack. It is best characterized as a server-side web backdoor used for persistent unauthorized access after initial compromise.