Two Face Webshell: Persistent Access Point for Lateral Movement
Summary: Unit 42 found a two-layer ASP.NET webshell it named TwoFace on a compromised Middle Eastern organization's server, where a loader written in C# decrypts and installs an embedded payload that accepts commands via HTTP POST. Server logs show commands from five IP addresses in four countries between June 18, 2016 and May 3, 2017, including Mimikatz credential theft and copies of TwoFace and other webshells to Exchange servers for lateral movement.
Why it matters: The actor held intermittent access to this shell for almost a year, and the commands show Mimikatz harvesting logged-in passwords before pivoting to other servers - so a single undetected webshell gave them repeated chances to widen the breach.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026