Loading malware…
RelayShell is a previously undocumented PHP webshell used by the Lazarus Group as covert relay infrastructure in Operation Dream Job intrusions. Rather than functioning primarily as a conventional interactive command shell on the compromised host, it repurposes exposed web applications and CMS servers as intermediary command-and-control nodes, passing operator commands and victim responses through a file-based messaging mechanism built around simple text or session files. This design helps blend malicious traffic into otherwise legitimate web activity and supports stealthier post-compromise communications.
RelayShell has been observed on compromised Roundcube webmail, WordPress, and PrestaShop servers. In reported Lazarus activity, many affected Roundcube instances were vulnerable to CVE-2025-49113, and operators were also assessed to have used stolen or leaked credentials to authenticate before exploitation and deployment. The malware has been described as supporting distinct operator and victim relay roles and enabling session management and message forwarding rather than serving mainly as a direct remote administration interface.
Its role in the broader intrusion set is infrastructural: compromised servers hosting RelayShell were used as relay nodes for Lazarus malware operations associated with defense, aerospace, and aviation targeting across multiple regions. High-confidence reporting supports RelayShell as part of the group’s persistence, defense-evasion, and post-exploitation tradecraft by allowing command traffic to traverse legitimate third-party web infrastructure instead of dedicated attacker-controlled servers.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The Check Point researchers noted that many of the affected Roundcube Webmail servers are vulnerable to remote code execution (RCE) flaw tracked as CVE-2025-49113. | Several compromised WordPress and Roundcube instances were found to be infected with a PHP webshell dubbed RelayShell.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Several compromised WordPress and Roundcube instances were found to be infected with a PHP webshell dubbed RelayShell.
13 distinct techniques documented for this family, organized by ATT&CK tactic.
At startup, the implant iterates through the configured servers in order, parsing each URL into its host and path components, establishing an HTTP connection
hijacks legitimate but compromised WordPress and SharePoint websites and vulnerable Roundcube webmail servers for use as ForestTiger command-and-control (C2) servers
4 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A PHP webshell found on compromised WordPress and Roundcube servers used as relay infrastructure for Lazarus backdoors.
Webshell installed on compromised internet-facing servers and used as a C2 relay to blend malicious communications into legitimate web traffic.
A previously undocumented PHP webshell used on compromised Roundcube and WordPress infrastructure as a relay for command-and-response traffic rather than a traditional interactive backdoor.
Novel PHP webshell used as a communication relay via text files on compromised servers.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.