China Chopper still active 9 years later
Summary: Cisco Talos documented significant China Chopper web shell activity over a two-year period beginning in June 2017, finding both IIS and Apache servers compromised with the tool nine years after its creation and without significant modification. The researchers traced three separate campaigns with different goals, including document and database exfiltration via WinRAR archives and SQL dumps, deployment of Sodinokibi and Gandcrab ransomware, a Monero miner, and credential theft using Mimikatz and procdump64.exe on lsass.exe.
What's compelling: Because China Chopper is a widely available public tool, its presence alone cannot be tied to any particular actor or group, and the three campaigns Talos documented ran for several months, corroborating an average intrusion detection time of over 180 days.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026