VShell

b36d30ad0a646eeed5f02b48ac6b02f2cd2c125df298252dc1070aeff80de3e3

b639aaf8596969a505f5072bef830045dc2d12d8e1b9595ca7167847f7584428

c56a5e1bd3be186d26a106464ee40c11d9631a806b5fca076781403e1037990e

c96c694edcf204a4a517f62bd9969b14e8f504a815a324f6097dcadbc0096f09

11e862accfc3f80899d081ff30d6795d151edc4f5cb7df894f7bec56d51433af

a6b9e11dd7457c49ef440964ef625cb34762d94b894e05925f92fc14d1e2b714

b8157a882e669dfd8372888888f56263ce10ae41f371750e3ae9f7f816b76094

d74ee8bb9337b8dd250ce28e0e8607680f83719a28906f6410aa4a6addbd720c

3ebb5316c670fdc6b56a237603d78468d39abdca51acdb4387b5e3562d61d863

T1620 Reflective Code Loading T1059 Command and Scripting Interpreter T1071.001 Web Protocols T1055 Process Injection T1027.009 Embedded Payloads T1105 Ingress Tool Transfer T1573 Encrypted Channel T1566.001 Spearphishing Attachment T1204.002 Malicious File T1113 Screen Capture T1090 Proxy T1095 Non-Application Layer Protocol T1046 Network Service Discovery T1036 Masquerading T1219 Remote Access Tools T1071.004 DNS T1190 Exploit Public-Facing Application T1543.003 Windows Service T1071 Application Layer Protocol T1083 File and Directory Discovery T1505.003 Web Shell T1136 Create Account T1078 Valid Accounts T1203 Exploitation for Client Execution T1021 Remote Services T1539 Steal Web Session Cookie T1059.004 Unix Shell T1090.001 Internal Proxy T1505 Server Software Component T1041 Exfiltration Over C2 Channel T1649 Steal or Forge Authentication Certificates T1027 Obfuscated Files or Information T1546.012 Image File Execution Options Injection T1140 Deobfuscate/Decode Files or Information T1564.001 Hidden Files and Directories T1106 Native API T1566 Phishing T1082 System Information Discovery T1057 Process Discovery T1189 Drive-by Compromise T1049 System Network Connections Discovery T1566.003 Spearphishing via Service T1566.002 Spearphishing Link T1210 Exploitation of Remote Services T1547 Boot or Logon Autostart Execution T1027.004 Compile After Delivery

Reported operators

Threat actors

15 named in public reporting

UNK_MassTraction

UNK_MassTraction repeatedly exploited Roundcube vulnerabilities to infiltrate university networks and used IceCube, SquareShell, and VShell.

UNC5174

Houken operators used open-source tools previously detailed as part of UNC5174 intrusion set such as: GOREVERSE, VShell, fscan or ffuff.

Earth Lumina

VShell is a full-fledged remote access trojan (RAT), programmed in Go... It has offensive capabilities such as capturing screenshots of victim computers, allows for browsing as well as uploading and downloading files, and the ability to remotely execute commands as a backdoor.

Larva-26009

the attacker installed VShell and GotoHTTP to gain control over the infected system

UAT-6382

Talos has so far found two types of payloads deployed by TetraLoader on the infected endpoints: ... VShell stager ... The payload received by the VShell stager is in fact the actual VShell implant. VShell is a GoLang-based implant that talks to its C2 and provides a wide variety of remote access trojan-based functionalities.

UAT-8302

The group deploys NetDraft, a .NET-based backdoor linked to the FinDraft and SquidDoor family, alongside an updated version of the CloudSorcerer backdoor and the VSHELL implant.

UNC6586

SNOWLIGHT, a VShell stager... The attack chains culminate in the deployment of NetDraft, CloudSorcerer (version 3.0), and VShell.

Jewelbug

VELETRIX carries a VShell shellcode which is an Offensive Security Tool, like Meterpreter, Cobalt Strike among others, which means that, when executed, it will communicate with the Command and Control server.

Earth Lamia

China-nexus groups (i.e., Earth Lamia, Jackpot Panda, UNC5174) deploying Cobalt Strike beacons, Sliver, and Vshell backdoors

Jackpot Panda

China-nexus groups (i.e., Earth Lamia, Jackpot Panda, UNC5174) deploying Cobalt Strike beacons, Sliver, and Vshell backdoors

Earth Krahang

After gaining access, the operators deployed SnakeC2, NEOBEACON (which abuses OneDrive and the Microsoft Graph API for C2), Cobalt Strike, VShell, and SoftEther VPN.

Earth Lusca

After gaining access, the operators deployed SnakeC2, NEOBEACON (which abuses OneDrive and the Microsoft Graph API for C2), Cobalt Strike, VShell, and SoftEther VPN.

Silver Fox

"The malware used in the campaign included ValleyRAT and VShell."

HAFNIUM

"CVE-2026-1731 (BeyondTrust) is associated with HAFNIUM and linked to Lumma Stealer, SparkRAT, and VShell malware deployments."

TGR-STA-1030

Among the tools put to use by the threat actor are command-and-control (C2) frameworks... VShell

Exploited software

Vulnerabilities linked to VShell

22 CVEs

MITRE ATT&CK

VShell in ATT&CK

46 distinct techniques

Techniques

46 techniques

Reporting

Research mentioning VShell

Jul 29

Malware News

Case Study: Targeted Attack Case on an MS-SQL Server Involving the Installation of GotoHTTP and SoftEther VPN - Malware Analysis - Malware Analysis, News and Indicators

A targeted attack on an MS-SQL server led to the deployment of XMRig CoinMiner along with multiple remote-access tools, according to AhnLab ASEC. The intrusion was attributed to the Larva-26009 threat actor, which went beyond the common pattern of opportunistic cryptomining on exposed SQL servers by also installing VShell, GotoHTTP, and SoftEther VPN to maintain control over the compromised system. The toolset indicates the attackers sought both monetization and persistent remote administration after the initial compromise. While coin miners are frequently observed in attacks against internet-exposed Microsoft SQL Server instances, the addition of tunneling and remote-management software suggests a more deliberate post-compromise operation designed to preserve access and expand attacker control over the victim environment.

Scworld

AI assistant used in cyberattack on Thailand's Ministry of Finance | brief | SC Media

Researchers reported an active espionage intrusion targeting Thailand’s Ministry of Finance, tied to exposed attacker infrastructure at 43.246.208[.]207 and additional linked hosts in Hong Kong and Malaysia. The operation used the open-source Hermes autonomous AI agent in unattended "YOLO" mode to enumerate ministry systems, map internal services, and assess privilege-escalation paths, while a previously undocumented cross-platform Go implant dubbed Hades was staged to maintain persistence on both Windows and Linux systems. Investigators also linked a VShell C2 server and the domain redhatupdating432.dnsrd.com to the activity. Recovered artifacts showed targeting of ministry administrative panels, mail infrastructure, Apache Hadoop and HiveServer2 environments, Apache Ambari, GlassFish, Alfresco, and internal document systems. The exposed directories contained exploit code, web shells, stolen credentials, credential-testing scripts, and Linux and IIS exploitation or privilege-escalation modules, while Hades reportedly supported command and control, file transfer, proxying, and screen capture. Investigators said the evidence indicates compromised internal access, though no data exfiltration had been confirmed at publication time, and assessed with low-to-moderate confidence that the operator was a Chinese-speaking or Sinophone threat actor based on infrastructure history, Chinese-language indicators, and use of FOFA.

Ahnlab Asec

Case Study: Targeted Attack Case on an MS-SQL Server Involving the Installation of GotoHTTP and SoftEther VPN - ASEC

Security Affairs

Thailand's Ministry of Finance Targeted With Hermes AI Agent Running Unattended, Hades Implant Staged

The Hacker News

Hacker Runs Hermes AI Agent Unattended for Post-Exploitation at Thai Finance Ministry