S0350 zwShell

malwareEnterprise

platformsWindows

also known aszwShell

zwShell is a remote access tool (RAT) written in Delphi that has been seen in the wild since the spring of 2010 and used by threat actors during Night Dragon.

techniques used (11)

ATT&CK techniques this enables or maps to.

T1016System Network Configuration Discovery
T1021.001Remote Desktop Protocol
T1021.002SMB/Windows Admin Shares
T1033System Owner/User Discovery
T1053.005Scheduled Task
T1059.003Windows Command Shell
T1070.004File Deletion
T1082System Information Discovery
T1083File and Directory Discovery
T1112Modify Registry
T1543.003Windows Service

used by campaigns (1)

Campaigns that use this.

C0002Night Dragon

source

Where this definition is published.

view on ATT&CK

scry

Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan