S0564 BlackMould

malwareEnterprise

platformsWindows

also known asBlackMould

BlackMould is a web shell based on China Chopper for servers running Microsoft IIS. First reported in December 2019, it has been used in malicious campaigns by GALLIUM against telecommunication providers.

techniques used (6)

ATT&CK techniques this enables or maps to.

T1005Data from Local System
T1059.003Windows Command Shell
T1071.001Web Protocols
T1083File and Directory Discovery
T1105Ingress Tool Transfer
T1680Local Storage Discovery

used by groups (1)

Threat groups associated with this.

G0093GALLIUM

source

Where this definition is published.

view on ATT&CK

scry

Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan