Threat intelligence / Malware

China Chopper

[China Chopper](https://attack.mitre.org/software/S0020) is a [Web Shell](https://attack.mitre.org/techniques/T1505/003) hosted on Web servers to provide access back into an enterprise network that does not rely on an infected system calling back to a remote command and control server.(Citation: Lee 2013) It has been used by several threat groups.(Citation: Dell TG-3390)(Citation: FireEye Periscope March 2018)(Citation: CISA AA21-200A APT40 July 2021)(Citation: Rapid7 HAFNIUM Mar 2021)

Malware

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[China Chopper](https://attack.mitre.org/software/S0020) is a [Web Shell](https://attack.mitre.org/techniques/T1505/003) hosted on Web servers to provide access back into an enterprise network that does not rely on an infected system calling back to a remote command and control server.(Citation: Lee 2013) It has been used by several threat groups.(Citation: Dell TG-3390)(Citation: FireEye Periscope March 2018)(Citation: CISA AA21-200A APT40 July 2021)(Citation: Rapid7 HAFNIUM Mar 2021)

Labels

malware

19 recorded

Relationships

uses

from APT41

Group

uses

from BackdoorDiplomacy

Group

uses

to Data from Local System

Technique

uses

to File and Directory Discovery

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Network Service Discovery

Technique

uses

to Password Guessing

Technique

uses

to Software Packing

Technique

uses

Technique

uses

to Web Protocols

Technique

uses

Technique

uses

to Windows Command Shell

Technique

uses

from Fox Kitten

Group

uses

Group

uses

Group

uses

Group

uses

from Mustang Panda

Group

uses

from Threat Group-3390

Group

uses

Group

7 external

References

mitre-attack

S0020

China Chopper

—

CISA AA21-200A APT40 July 2021

https://us-cert.cisa.gov/ncas/alerts/aa21-200a

Dell TG-3390

https://www.secureworks.com/research/threat-group-3390-targets-organizations-for-cyberespionage

Rapid7 HAFNIUM Mar 2021

https://www.rapid7.com/blog/post/2021/03/23/defending-against-the-zero-day-analyzing-attacker-behavior-post-exploitation-of-microsoft-exchange/

FireEye Periscope March 2018

https://www.fireeye.com/blog/threat-research/2018/03/suspected-chinese-espionage-group-targeting-maritime-and-engineering-industries.html

Lee 2013

https://www.fireeye.com/blog/threat-research/2013/08/breaking-down-the-china-chopper-web-shell-part-i.html