H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Caterpillar WebShell](https://attack.mitre.org/software/S0572) is a self-developed Web Shell tool created by the group [Volatile Cedar](https://attack.mitre.org/groups/G0123).(Citation: ClearSky Lebanese Cedar Jan 2021)

Labels

malware

16 recorded

Relationships

uses

to Brute Force

Technique

uses

to Data from Local System

Technique

uses

to Exfiltration Over C2 Channel

Technique

uses

to File and Directory Discovery

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Local Groups

Technique

uses

to Modify Registry

Technique

uses

to Network Service Discovery

Technique

uses

to Process Discovery

Technique

uses

to Rootkit

Technique

uses

to System Information Discovery

Technique

uses

to System Network Configuration Discovery

Technique

uses

to System Owner/User Discovery

Technique

uses

to System Service Discovery

Technique

uses

to Windows Command Shell

Technique

uses

from Volatile Cedar

Group

4 external

References

mitre-attack

S0572

open

Caterpillar WebShell

—

ClearSky Lebanese Cedar Jan 2021

https://www.clearskysec.com/wp-content/uploads/2021/01/Lebanese-Cedar-APT.pdf

open

CheckPoint Volatile Cedar March 2015

https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2015/03/20082004/volatile-cedar-technical-report.pdf

open