software

China Chopper

activeentity:software

[China Chopper](https://attack.mitre.org/software/S0020) is a [Web Shell](https://attack.mitre.org/techniques/T1505/003) hosted on Web servers to provide access back into an enterprise network that does not rely on an infected system calling back to a remote command and control server.(Citation: Lee 2013) It has been used by several threat groups.(Citation: Dell TG-3390)(Citation: FireEye Periscope March 2018)(Citation: CISA AA21-200A APT40 July 2021)(Citation: Rapid7 HAFNIUM Mar 2021)

Curated · btcintel

claims we make, each with its source and citation · sources may contradict; we show the set, never a score

Facts

id: china-chopper
kind: software
status: active
aliases: —
jurisdictions: —
claims naming it: 0 · 0 attributions · 9 relations · 0 events

Identifiers

attack S0020via mitre-attack

Relations

MITRE ATT&CK Enterpriserecords thatGALLIUMusesChina Chopper
fetch —sha256 dc1639caa5501d72
rel_25btcintel:relations:25@v1 sha256:846f4985ec81b535
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatAPT41usesChina Chopper
fetch —sha256 dc1639caa5501d72
rel_72btcintel:relations:72@v1 sha256:e509f88f78584e4d
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatHAFNIUMusesChina Chopper
fetch —sha256 dc1639caa5501d72
rel_115btcintel:relations:115@v1 sha256:2fbde9fe6ae35ece
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatMUSTANG PANDAusesChina Chopper
fetch —sha256 dc1639caa5501d72
rel_211btcintel:relations:211@v1 sha256:a3037e7bf5b9e3a9
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatLeviathanusesChina Chopper
fetch —sha256 dc1639caa5501d72
rel_334btcintel:relations:334@v1 sha256:8c5aefa8af9d2137
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatBackdoorDiplomacyusesChina Chopper
fetch —sha256 dc1639caa5501d72
rel_450btcintel:relations:450@v1 sha256:22cda5cf3f5858ab
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatToddyCatusesChina Chopper
fetch —sha256 dc1639caa5501d72
rel_478btcintel:relations:478@v1 sha256:06d142fa69396f29
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatFox KittenusesChina Chopper
fetch —sha256 dc1639caa5501d72
rel_524btcintel:relations:524@v1 sha256:a05eebd63cbc33e4
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatThreat Group-3390usesChina Chopper
fetch —sha256 dc1639caa5501d72
rel_647btcintel:relations:647@v1 sha256:21544fdf97a78acd
confidenceauthority data · 60

Events

computedno dated events recorded for this entity

Claims naming this entity

computedno current claim names this entity

Subjects0 subjects carry a claim naming this entity · a sample

computedno subject carries a claim naming this entity

Community

notes from Nostr labelers · never merged with the bands above · not endorsed

Community content is indexed from Nostr and not endorsed by btcintel.

not computed yetNot indexed yet: the community index has not looked at this subject.