H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[P.A.S. Webshell](https://attack.mitre.org/software/S0598) is a publicly available multifunctional PHP webshell in use since at least 2016 that provides remote access and execution on target web servers.(Citation: ANSSI Sandworm January 2021)

Labels

malware

17 recorded

Relationships

uses

from Ember Bear

Group

uses

to Command and Scripting Interpreter

Technique

uses

to Databases

Technique

uses

to Data from Local System

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to File and Directory Discovery

Technique

uses

to File Deletion

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Linux and Mac Permissions

Technique

uses

to Local Account

Technique

uses

to Network Service Discovery

Technique

uses

to Obfuscated Files or Information

Technique

uses

to Password Guessing

Technique

uses

to Software Discovery

Technique

uses

to Web Protocols

Technique

uses

to Web Shell

Technique

uses

from Sandworm Team

Group

4 external

References

mitre-attack

S0598

open

Fobushell

—

ANSSI Sandworm January 2021

https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf

open

NCCIC AR-17-20045 February 2017

https://us-cert.cisa.gov/sites/default/files/publications/AR-17-20045_Enhanced_Analysis_of_GRIZZLY_STEPPE_Activity.pdf

open