TF-1932510 medium

Description

Indicator that identifies a botnet command&control server (C&C). IOC type: Domain that is used for botnet Command&control (C&C). Attributed malware: php.shin_webshell. Confidence: 50. First seen: 2026-09-24 23:42:09 UTC. Reporter: xscon. Tags: Cloudflare, gif, PHP, webshell, WordPress, workers.dev, wp-admin.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

References (2)

• Malpedia profile ThreatFox IOCs
• ThreatFox IOC page ThreatFox IOCs

  Indicator that identifies a botnet command&control server (C&C). IOC type: Domain that is used for botnet Command&control (C&C). Attributed malware: php.shin_webshell. Confidence: 50. First seen: 2026-09-24 23:42:09 UTC. Reporter: xscon. Tags: Cloudflare, gif, PHP, webshell, WordPress, workers.dev, wp-admin.

• ThreatFox: php.shin_webshell IOCs | SOC Hunt Feed
  web:davidgodwinpratt.com

  Hunt Hypothesis This detection rule identifies adversary behavior involving the deployment of the php.shin_webshell backdoor to establish persistent access and execute arbitrary commands on compromised web servers. SOC teams should proactively hunt for these specific IOCs in Azure Sentinel because this high-severity threat enables attackers to maintain a covert foothold, facilitating lateral ...

  2026-09-25 04:44 UTC
• ThreatFox: php.shin_webshell IOCs | SOC Hunt Feed
  web:davidgodwinpratt.com

  Here are specific false positive scenarios and corresponding filters for the ThreatFox: php.shin_webshell detection rule in an enterprise environment: Scenario: Legitimate deployment of a new PHP-based internal dashboard or customer portal by the DevOps team using CI/CD pipelines (e.g., Jenkins, GitLab CI).

  2026-09-25 04:44 UTC
• ThreatFox: php.shin_webshell IOCs | SOC Hunt Feed
  web:davidgodwinpratt.com

  Hunt Hypothesis This hunt detects adversary activity involving the php.shin_webshell web shell, a tool frequently used by threat actors to establish persistent access and execute commands on compromised PHP-based servers. A SOC team should proactively search for these specific IOCs in Azure Sentinel because early identification of this web shell can prevent lateral movement and data ...

  2026-09-25 04:44 UTC
• PHP Webshell: How to Detect and Remove One - safeguard.sh
  web:safeguard.sh

  A PHP webshell gives attackers remote control of a server. Learn how they get planted, what the code looks like, and how to detect and remove one.

  2026-09-25 04:44 UTC
• ThreatFox | nelonu.workers.dev
  web:threatfox.abuse.ch

  ThreatFox IOC Database You are viewing the ThreatFox database entry for domain nelonu.workers.dev. Database Entry Actions ... xscon This IOC is reference the injection webshell using Worker Clouflare, infected using polyglot file php over gif in WordPress.

  2026-09-25 04:44 UTC
• ThreatFox | tocawyso.workers.dev
  web:threatfox.abuse.ch

  This IOC is reference the injection webshell using Worker Clouflare, infected using polyglot file php over gif in WordPress.

  2026-09-25 04:44 UTC
• ThreatFox | 1904objective.workers.dev
  web:threatfox.abuse.ch

  This IOC is reference the injection webshell using Worker Clouflare, infected using polyglot file php over gif in WordPress.

  2026-09-25 04:44 UTC
• Cloudflare Workers as Webshell C2: The php.shin_webshell Cluster ...
  web:www.threatclaw.ai

  EDR / endpoint detections (the real kill-chain anchor): The webshell still needs a victim host to invoke. Monitor for outbound HTTP requests from web servers (IIS/Nginx/Apache workers) to workers.dev endpoints that POST or receive image-content responses. Correlate with the surrounding process (php-cgi, w3wp, httpd) command line and child process spawns.

  2026-09-25 04:44 UTC
• Cloudflare Workers as Covert C2: The php.shin_webshell "worker.botnet ...
  web:www.threatclaw.ai

  The php.shin_webshell payload itself is a classic post-exploitation webshell that , once dropped on a target edge server, would blend into routine PHP traffic. This is not a replacement for the proven C2 cohort above — it's an escalation path.

  2026-09-25 04:44 UTC
• Remus Stealer's Weaponized Cloudflare Workers: php.shin_webshell Gif ...
  web:www.threatclaw.ai

  The Cloudflare Workers Webshell Family ( php.shin_webshell ) Three domains — qhvdg6q2ob.workers.dev, 591jemmy.workers.dev, and the previously-flagged ck.erloro.com pattern — are hosting php.shin_webshell with conf:50-85 and tag Cloudflare,gif,PHP. This is not a coincidence of naming.

  2026-09-25 04:44 UTC

Only Available for Registered Users. Sign in to view.