TF-1931106 medium

Description

Indicator that identifies a botnet command&control server (C&C). IOC type: Domain that is used for botnet Command&control (C&C). Attributed malware: php.shin_webshell. Confidence: 50. First seen: 2026-09-23 23:26:37 UTC. Reporter: xscon. Tags: Cloudflare, gif, PHP, webshell, WordPress, workers.dev, wp-admin.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

References (2)

• Malpedia profile ThreatFox IOCs
• ThreatFox IOC page ThreatFox IOCs

  Indicator that identifies a botnet command&control server (C&C). IOC type: Domain that is used for botnet Command&control (C&C). Attributed malware: php.shin_webshell. Confidence: 50. First seen: 2026-09-23 23:26:37 UTC. Reporter: xscon. Tags: Cloudflare, gif, PHP, webshell, WordPress, workers.dev, wp-admin.

• php.shin_webshell — Malware Analysis & Detection | BotEraser
  web:boteraser.com

  php.shin_webshell is a PHP-based backdoor webshell, first documented in public threat intelligence reports around 2019 by Fortinet's FortiGuard Labs. It is categorized as a Web Shell and is typically deployed on compromised web servers to grant attackers persistent remote access.

  2026-09-24 03:22 UTC
• ThreatFox: php.shin_webshell IOCs | SOC Hunt Feed
  web:davidgodwinpratt.com

  Hunt Hypothesis This hunt detects adversary activity involving the deployment of the php.shin_webshell backdoor, which attackers utilize to establish persistent access and execute arbitrary commands on compromised web servers. Proactively hunting for these specific IOCs in Azure Sentinel is critical because this webshell often serves as an initial foothold that enables lateral movement and ...

  2026-09-24 03:22 UTC
• ThreatFox: php.shin_webshell IOCs | SOC Hunt Feed
  web:davidgodwinpratt.com

  Hunt Hypothesis This detection rule identifies adversary behavior involving the deployment of the php.shin_webshell backdoor to establish persistent access and execute arbitrary commands on compromised web servers. SOC teams should proactively hunt for these specific IOCs in Azure Sentinel because this high-severity threat enables attackers to maintain a covert foothold, facilitating lateral ...

  2026-09-24 03:22 UTC
• ThreatFox: php.shin_webshell IOCs | SOC Hunt Feed
  web:davidgodwinpratt.com

  The php.shin_webshell malware enables remote code execution and persistence by leveraging compromised web servers to exfiltrate data and execute arbitrary commands. It typically arrives via phishing emails, exploit kits, or compromised third-party plugins, often masquerading as legitimate administrative tools. SOC analysts should monitor for ...

  2026-09-24 03:22 UTC
• ThreatFox: php.shin_webshell IOCs | SOC Hunt Feed
  web:davidgodwinpratt.com

  Here are specific false positive scenarios and corresponding filters for the ThreatFox: php.shin_webshell detection rule in an enterprise environment: Scenario: Legitimate deployment of a new PHP-based internal dashboard or customer portal by the DevOps team using CI/CD pipelines (e.g., Jenkins, GitLab CI).

  2026-09-24 03:22 UTC
• ThreatFox: php.shin_webshell IOCs | SOC Hunt Feed
  web:davidgodwinpratt.com

  Hunt Hypothesis This hunt detects adversary activity involving the php.shin_webshell web shell, a tool frequently used by threat actors to establish persistent access and execute commands on compromised PHP-based servers. A SOC team should proactively search for these specific IOCs in Azure Sentinel because early identification of this web shell can prevent lateral movement and data ...

  2026-09-24 03:22 UTC
• ThreatFox | boporume-c60.workers.dev
  web:threatfox.abuse.ch

  This IOC is reference the injection webshell using Worker Clouflare, infected using polyglot file php over gif in WordPress.

  2026-09-24 03:22 UTC
• ThreatFox | jonelate.workers.dev
  web:threatfox.abuse.ch

  This IOC is reference the injection webshell using Worker Clouflare, infected using polyglot file php over gif in WordPress.

  2026-09-24 03:22 UTC
• Cloudflare Workers as Covert C2: The php.shin_webshell "worker.botnet ...
  web:www.threatclaw.ai

  The php.shin_webshell payload itself is a classic post-exploitation webshell that , once dropped on a target edge server, would blend into routine PHP traffic. This is not a replacement for the proven C2 cohort above — it's an escalation path.

  2026-09-24 03:22 UTC
• Remus Stealer's Weaponized Cloudflare Workers: php.shin_webshell Gif ...
  web:www.threatclaw.ai

  The Cloudflare Workers Webshell Family ( php.shin_webshell ) Three domains — qhvdg6q2ob.workers.dev, 591jemmy.workers.dev, and the previously-flagged ck.erloro.com pattern — are hosting php.shin_webshell with conf:50-85 and tag Cloudflare,gif,PHP. This is not a coincidence of naming.

  2026-09-24 03:22 UTC

Only Available for Registered Users. Sign in to view.