S9028 PHPsert

malwareEnterprise

platformsNetwork Devices

also known asPHPsert

PHPsert is a webshell used to execute PHP code that has been in use since at least 2023 against targets in Japan, Singapore, Peru, Taiwan, Iran, Republic of Korea, and the Philippines. PHPsert is not typically deployed as a standalone but integrated into web content such as text editors and content management systems.

techniques used (6)

ATT&CK techniques this enables or maps to.

T1027.013Encrypted/Encoded File
T1071.001Web Protocols
T1105Ingress Tool Transfer
T1132.001Standard Encoding
T1140Deobfuscate/Decode Files or Information
T1505.003Web Shell

used by campaigns (1)

Campaigns that use this.

C0061Operation Digital Eye

source

Where this definition is published.

view on ATT&CK

scry

Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan