H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Malware

BlackMould

[BlackMould](https://attack.mitre.org/software/S0564) is a web shell based on [China Chopper](https://attack.mitre.org/software/S0020) for servers running Microsoft IIS. First reported in December 2019, it has been used in malicious campaigns by [GALLIUM](https://attack.mitre.org/groups/G0093) against telecommunication providers.(Citation: Microsoft GALLIUM December 2019)

Malware
TypeMalware
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[BlackMould](https://attack.mitre.org/software/S0564) is a web shell based on [China Chopper](https://attack.mitre.org/software/S0020) for servers running Microsoft IIS. First reported in December 2019, it has been used in malicious campaigns by [GALLIUM](https://attack.mitre.org/groups/G0093) against telecommunication providers.(Citation: Microsoft GALLIUM December 2019)

Labels

malware
7 recorded

Relationships

uses
to Data from Local System
Technique
uses
to File and Directory Discovery
Technique
uses
to Ingress Tool Transfer
Technique
uses
to Local Storage Discovery
Technique
uses
to Web Protocols
Technique
uses
to Windows Command Shell
Technique
uses
from GALLIUM
Group
2 external

References

mitre-attack
S0564
open
Microsoft GALLIUM December 2019
https://www.microsoft.com/security/blog/2019/12/12/gallium-targeting-global-telecom/
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance