H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Malware

ASPXSpy

[ASPXSpy](https://attack.mitre.org/software/S0073) is a Web shell. It has been modified by [Threat Group-3390](https://attack.mitre.org/groups/G0027) actors to create the ASPXTool version. (Citation: Dell TG-3390)

Malware
TypeMalware
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[ASPXSpy](https://attack.mitre.org/software/S0073) is a Web shell. It has been modified by [Threat Group-3390](https://attack.mitre.org/groups/G0027) actors to create the ASPXTool version. (Citation: Dell TG-3390)

Labels

malware
7 recorded

Relationships

uses
from Agrius
Group
uses
from APT39
Group
uses
from APT41
Group
uses
to Web Shell
Technique
uses
from HAFNIUM
Group
uses
from Night Dragon
Campaign
uses
from Threat Group-3390
Group
2 external

References

mitre-attack
S0073
open
Dell TG-3390
https://www.secureworks.com/research/threat-group-3390-targets-organizations-for-cyberespionage
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance