Supply Chain
Crimeware Has an Attack Surface. We Catalogue It.
Standard threat-intelligence indexes malware by hash and family. Our Cyber Arsenal indexes the other thing — the vulnerabilities of the malware itself: the pre-auth RCE, the broken cookie validation, and the backdoors that the tools' own distributors wired into them. Over 40% of the commodity webshells and grabbers we catalogued are harvesting the operators who deploy them.
4 min readWSO (Web Shell by Orb)
The workhorse of the Russian webshell scene — compact, battle-tested, zero authentication on default install, and carrying a W0rm supply-chain backdoor that gives a third party unauthenticated RCE on every host the operator compromises. Five independent attack surfaces. Highest severity in corpus.
YARA 5 min readwhmcs-killer-v3
WHMCS-targeting webshell with six independent attack vectors — W0rm supply-chain RCE, trivial client-side session forgery, pre-auth file inclusion with eval, arbitrary file upload, SQL injection, and stored XSS. Every vector is pre-auth. Harvests the WHMCS billing database: client records, payment details, hosting credentials, domain registrations.
YARA 4 min readviper.php (Viper 1337)
Minimal file uploader ecosystem by Viper 1337 — multiple variants (XxX.php, 098.php, pwn.php) carrying a Hmei7-linked supply-chain beacon in base64-encoded eval blocks. One variant uses GIF89a magic-byte prefix for MIME-type evasion.
YARA 4 min readunzipper
Legitimate archive extraction utility poisoned with W0rm supply-chain injection. Pre-auth RCE on every request, dynamic C2 email via MD5-of-Pastebin, and a dedupe mechanism that reports each compromised install exactly once.
YARA 4 min readsymlink.php
cPanel privilege escalation tool using symlink traversal across account boundaries — also carrying a W0rm supply-chain injection with pre-auth RCE that fires before any of the tool's own cookie-based authentication.
YARA 4 min readStupidc0de Backdoor
The flagship Tier-2 card. 90 KB / 2030 lines — the largest tool in the corpus. Indonesian scene (Stupidc0de Family: Putra-Attacker, Daryun, Shor7cut, Osvaldas, Sinkaroid). Zero authentication on 12+ function modules. Pre-auth RCE, LFI, and arbitrary upload all confirmed live. Five runtime supply-chain remote-includes. WordPress admin reset module. zone-h mass-defacement notifier.
YARA 4 min readshell-checker (selmasker)
Disguised as a webshell validation tool — but the checker is the shell. Indonesian scene (JExCoders / XploitSec-ID). Every string literal is base64-encoded to defeat grep. Hidden GET-branch backdoor accepts unauthenticated file uploads to the webroot — confirmed live. Config-trap pattern: operator fills in their own email, making every hit report to them (and to anyone reading the source).
YARA 4 min readr57
Classic Russian webshell and one of the earliest full-featured PHP shells to circulate widely. Carries a W0rm supply-chain backdoor and a pre-auth local file inclusion on the very first line of source — the operator's tool is compromised before it even loads.
YARA 4 min readIndoXploit
Indonesian-scene webshell with 10 outbound TLS-disabled connections, a W0rm supply-chain backdoor that fires on every unauthenticated visit, and trivially crackable MD5 auth. Every deployment is MITM-able and pre-auth exploitable simultaneously.
YARA 4 min readFlash-X uploaders
Two minimal uploaders (~1.7 KB each) with byte-identical hidden mail() beacons to the kit author. Attributed to XPROADSHELL / BAZOOKA, distributed by 0XNIGHTSEC. The beacons fire on every page load, invisible to the operator. Half-broken obfuscation leaks two author handles from one file. Re-skin only difference between variants.
YARA 4 min readdbkiss
Legitimate open-source database admin tool (DBKiss 1.11) with the most discreet W0rm supply-chain injection in the corpus. The backdoor hides inside a define() block and fires pre-auth at PHP parse time — before the application even starts.
YARA 4 min readb374k
Gold standard compact webshell with anti-bot 404 evasion. Returns a fake 404 page to automated scanners while serving the real shell to interactive browsers. W0rm supply-chain infected in redistributed copies.
YARA 4 min readAlfa3
The kit's 'alfa3.php' is not a separate, older 'alfa3' family — it is an Alfa Shell V4 'Tesla' build, with the Hmei7 mail() surveillance beacon and create_function obfuscation. It is a distinct file from alfav4-tesla.php (different hash and size), not a byte-identical copy.
YARA 4 min readAlfa Shell V4 "Tesla"
The most deployed variant of the Alfa webshell family. Full-featured control panel with file manager, database browser, and CGI backdoor installer — and a hidden mail() beacon that reports every compromised host back to the kit author.
YARA 5 min read0byt3m1n1-V2
File manager webshell v2.2 with zero authentication and a runtime supply-chain dropper. Indonesian scene (zerobyte-id). No password, no session, no token — every function is open to any visitor. On every page load, fetches its own source from a hardcoded GitHub URL and writes it to the webroot.
YARA 4 min read