S1187 reGeorg

malwareEnterprise

platformsNetwork Devices · Windows · macOS · Linux

also known asreGeorg

reGeorg is an open-source web shell written in Python that can be used as a proxy to bypass firewall rules and tunnel data in and out of targeted networks.

techniques used (10)

ATT&CK techniques this enables or maps to.

T1021.001Remote Desktop Protocol
T1021.002SMB/Windows Admin Shares
T1021.004SSH
T1059.006Python
T1071.001Web Protocols
T1090Proxy
T1095Non-Application Layer Protocol
T1105Ingress Tool Transfer
T1505.003Web Shell
T1572Protocol Tunneling

used by groups (3)

Threat groups associated with this.

G0007APT28
G0016APT29
G1003Ember Bear

source

Where this definition is published.

view on ATT&CK

scry

Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan