LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S0412: ZxShell

ZxShell is a remote administration tool and backdoor that can be downloaded from the Internet, particularly from Chinese hacker websites. It has been used since at least 2004.[1][2]

EnterpriseS0412MalwareObject v1.2Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

ZxShell matters because it represents a Windows remote administration/backdoor capability with a long public history and ATT&CK relationships to discovery, credential collection, lateral movement, command-and-control, proxying, tool transfer, and cleanup behaviors. For leaders, the practical issue is not the malware name alone; it is whether Windows endpoint, identity, remote access, and network monitoring can prove what happened after a backdoor is present.

Executive priority

Prioritize ZxShell-related readiness where Windows systems support sensitive operations, regulated data, or remote administration pathways. The ATT&CK relationships point to business-impacting questions: can the organization detect unauthorized RDP/VNC use, credential capture attempts, registry changes, local discovery, inbound tool transfer, and web/file-transfer based command-and-control? This is useful for incident response planning, audit evidence around privileged access and endpoint monitoring, and control prioritization for remote access and Windows hardening.

Technical view

Treat ZxShell as a Windows backdoor/RAT profile with relationship-driven validation across execution, discovery, credential access, lateral movement, command-and-control, persistence/defense impairment, and stealth. ATT&CK does not provide official detection text for this software, so SOC teams should map detections to the linked techniques: Windows command shell execution, Native API behavior, DLL injection, keylogging/API hooking indicators, registry query and modification, service/process/user/system/file discovery, RDP and VNC activity, proxy behavior, web and file-transfer C2 patterns, ingress tool transfer, and file deletion. Group relationships to Axiom, Threat Group-3390, and APT41 provide threat-intelligence context, but local evidence is required before making attribution or exposure claims.

Likely telemetry

  • Windows endpoint process creation and command-line telemetry, especially cmd.exe and discovery utilities
  • Windows registry access and modification events
  • EDR telemetry for DLL injection, suspicious API usage, credential API hooking, and keylogging-like behavior
  • Windows service, process, user, system, file, and directory enumeration events
  • Authentication and remote access logs for RDP and VNC sessions

Detection direction

  • Because ATT&CK provides no official detection guidance for ZxShell, build coverage from the related techniques rather than relying on a malware-specific signature alone.
  • Validate that Windows endpoint detections correlate discovery sequences, registry activity, command-shell execution, and network connections from the same host or user context.
  • Tune remote access monitoring for unusual RDP or VNC use, especially new source/destination pairs, atypical times, or sessions inconsistent with normal administration.
  • Review C2-oriented detections for web and file-transfer protocols, but account for high false-positive potential because these protocols are common in enterprise environments.
  • Look for proxy or relay behavior that may hide direct infrastructure connections, including unexpected internal-to-external forwarding patterns.

Mitigation priorities

  • Start with remote access governance: restrict and monitor RDP and VNC, require strong authentication, and ensure administrative access is limited and reviewable.
  • Harden Windows endpoints against persistence and defense impairment by controlling registry modification paths, privileged execution, and unauthorized administrative tooling.
  • Ensure endpoint protection and EDR policies are configured to observe injection, credential capture, suspicious command execution, and file deletion behaviors.
  • Strengthen egress controls and logging for web, proxy, and file-transfer protocols so command-and-control and tool transfer activity has reviewable evidence.
  • Maintain incident response procedures for Windows backdoor cases, including host isolation, credential reset decisions, registry and filesystem review, and scoping of lateral movement.
Additional notes and limits

Official ATT&CK identifies ZxShell as a remote administration tool and backdoor downloadable from the Internet, particularly from Chinese hacker websites, and states it has been used since at least 2004. ATT&CK relationships associate it with Axiom, Threat Group-3390, and APT41, and with numerous techniques spanning discovery, execution, credential access, lateral movement, command-and-control, persistence/defense impairment, stealth, and collection. The object platform is Windows; some related technique platform lists are broader because they describe the general ATT&CK technique, not necessarily this malware instance.

No official ATT&CK detection text, aliases, labels, or malware-level tactics are supplied. The summary is based only on the provided STIX fields, external references, and relationships. It does not assert current exploitation, customer exposure, guaranteed detection, or attribution. Local telemetry, binaries, network indicators, and case evidence are required for operational conclusions.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

ZxShell

ZxShell is a remote administration tool and backdoor that can be downloaded from the Internet, particularly from Chinese hacker websites. It has been used since at least 2004.[1][2]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

34 rows
DomainIDNameRelationship / procedure
EnterpriseT1021.005VNCSub-technique

ZxShell supports functionality for VNC sessions.[2]

EnterpriseT1082System Information Discovery

ZxShell can collect the local hostname, operating system details, CPU speed, and total physical memory.[2]

EnterpriseT1090Proxy

ZxShell can set up an HTTP or SOCKS proxy.[1][2]

EnterpriseT1071.001Web ProtocolsSub-technique

ZxShell has used HTTP for C2 connections.[2]

EnterpriseT1571Non-Standard Port

ZxShell can use ports 1985 and 1986 in HTTP/S communication.[2]

EnterpriseT1056.004Credential API HookingSub-technique

ZxShell hooks several API functions to spawn system threads.[2]

EnterpriseT1083File and Directory Discovery

ZxShell has a command to open a file manager and explorer on the system.[2]

EnterpriseT1113Screen Capture

ZxShell can capture screenshots.[1]

EnterpriseT1012Query Registry

ZxShell can query the netsvc group value data located in the svchost group Registry key.[2]

EnterpriseT1005Data from Local System

ZxShell can transfer files from a compromised host.[2]

EnterpriseT1033System Owner/User Discovery

ZxShell can collect the owner and organization information from the target workstation.[2]

EnterpriseT1190Exploit Public-Facing Application

ZxShell has been dropped through exploitation of CVE-2011-2462, CVE-2013-3163, and CVE-2014-0322.[2]

EnterpriseT1057Process Discovery

ZxShell has a command, ps, to obtain a listing of processes on the system.[2]

EnterpriseT1046Network Service Discovery

ZxShell can launch port scans.[1][2]

EnterpriseT1112Modify Registry

ZxShell can create Registry entries to enable services to run.[2]

EnterpriseT1070.004File DeletionSub-technique

ZxShell can delete files from the system.[1][2]

EnterpriseT1543.003Windows ServiceSub-technique

ZxShell can create a new service using the service parser function ProcessScCommand.[2]

EnterpriseT1685Disable or Modify Tools

ZxShell can kill AV products' processes.[2]

EnterpriseT1071.002File Transfer ProtocolsSub-technique

ZxShell has used FTP for C2 connections.[2]

EnterpriseT1055.001Dynamic-link Library InjectionSub-technique

ZxShell is injected into a shared SVCHOST process.[2]

EnterpriseT1059.003Windows Command ShellSub-technique

ZxShell can launch a reverse command shell.[1][2][4]

EnterpriseT1686Disable or Modify System Firewall

ZxShell can disable the firewall by modifying the registry key HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile.[2]

EnterpriseT1021.001Remote Desktop ProtocolSub-technique

ZxShell has remote desktop functionality.[2]

EnterpriseT1134.002Create Process with TokenSub-technique

ZxShell has a command called RunAs, which creates a new process as another user or process context.[2]

EnterpriseT1125Video Capture

ZxShell has a command to perform video device spying.[2]

EnterpriseT1218.011Rundll32Sub-technique

ZxShell has used rundll32.exe to execute other DLLs and named pipes.[2]

EnterpriseT1136.001Local AccountSub-technique

ZxShell has a feature to create local user accounts.[2]

EnterpriseT1499Endpoint Denial of Service

ZxShell has a feature to perform SYN flood attack on a host.[1][2]

EnterpriseT1106Native API

ZxShell can leverage native API including RegisterServiceCtrlHandler to register a service.RegisterServiceCtrlHandler

EnterpriseT1569.002Service ExecutionSub-technique

ZxShell can create a new service for execution.[2]

EnterpriseT1685.005Clear Windows Event LogsSub-technique

ZxShell has a command to clear system event logs.[2]

EnterpriseT1056.001KeyloggingSub-technique

ZxShell has a feature to capture a remote computer's keystrokes using a keylogger.[1][2]

EnterpriseT1007System Service Discovery

ZxShell can check the services on the system.[2]

EnterpriseT1105Ingress Tool Transfer

ZxShell has a command to transfer files from a remote host.[2]

Associated objects

Groups, software, and campaigns

GroupEnterprise

G0001: Axiom

Axiom is a suspected Chinese cyber espionage group that has targeted the aerospace, defense, government, manufacturing, and media sectors since at least 2008. Some reporting suggests a degree of overlap between Axiom and Winnti Group but the two groups appear to be distinct based on differences in reporting on TTPs and targeting.[1][2][3]

GroupEnterprise

G0096: APT41

APT41 is a threat group that researchers have assessed as Chinese state-sponsored espionage group that also conducts financially-motivated operations. Active since at least 2012, APT41 has been observed targeting various industries, including but not limited to healthcare, telecom, technology, finance, education, retail and video game industries in 14 countries.[1] Notable behaviors include using a wide range of malware and tools to complete mission objectives. APT41 overlaps at least partially with public reporting on groups including BARIUM and Winnti Group.[2][3]

GroupEnterprise

G0027: Threat Group-3390

Threat Group-3390 is a Chinese threat group that has extensively used strategic Web compromises to target victims.[1] The group has been active since at least 2010 and has targeted organizations in the aerospace, government, defense, technology, energy, manufacturing and gambling/betting sectors.[2][3][4]

Relationship explorer

All related ATT&CK context

uses · GroupG0001: AxiomEnterpriseuses · TechniqueT1021.005: VNCEnterpriseuses · TechniqueT1082: System Information DiscoveryEnterpriseuses · TechniqueT1090: ProxyEnterpriseuses · TechniqueT1071.001: Web ProtocolsEnterpriseuses · TechniqueT1571: Non-Standard PortEnterpriseuses · TechniqueT1056.004: Credential API HookingEnterpriseuses · TechniqueT1083: File and Directory DiscoveryEnterpriseuses · TechniqueT1113: Screen CaptureEnterpriseuses · GroupG0096: APT41Enterpriseuses · TechniqueT1012: Query RegistryEnterpriseuses · TechniqueT1005: Data from Local SystemEnterpriseuses · TechniqueT1033: System Owner/User DiscoveryEnterpriseuses · TechniqueT1190: Exploit Public-Facing ApplicationEnterpriseuses · TechniqueT1057: Process DiscoveryEnterpriseuses · TechniqueT1046: Network Service DiscoveryEnterpriseuses · TechniqueT1112: Modify RegistryEnterpriseuses · TechniqueT1070.004: File DeletionEnterpriseuses · TechniqueT1543.003: Windows ServiceEnterpriseuses · TechniqueT1685: Disable or Modify ToolsEnterpriseuses · TechniqueT1071.002: File Transfer ProtocolsEnterpriseuses · TechniqueT1055.001: Dynamic-link Library InjectionEnterpriseuses · TechniqueT1059.003: Windows Command ShellEnterpriseuses · TechniqueT1686: Disable or Modify System FirewallEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.2
Created
Modified
Raw hash
a37cc1a95112c2df...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.2Current bundlea37cc1a95112…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    FireEye APT41 Aug 2019

    Fraser, N., et al. (2019, August 7). Double DragonAPT41, a dual espionage and cyber crime operation APT41. Retrieved September 23, 2019.

    Open source URL
  2. [2]
    Talos ZxShell Oct 2014

    Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019.

    Open source URL
  3. [3]
    Cisco Group 72

    Esler, J., Lee, M., and Williams, C. (2014, October 14). Threat Spotlight: Group 72. Retrieved January 14, 2016.

  4. [4]
    Secureworks BRONZEUNION Feb 2019

    Counter Threat Unit Research Team. (2019, February 27). A Peek into BRONZE UNION’s Toolbox. Retrieved September 24, 2019.

    Open source URL
  5. [5]
    FireEye APT41 Aug 2019

    Fraser, N., et al. (2019, August 7). Double DragonAPT41, a dual espionage and cyber crime operation APT41. Retrieved September 23, 2019.

    Open source URL
  6. [6]
    FireEye APT41 Aug 2019

    Fraser, N., et al. (2019, August 7). Double DragonAPT41, a dual espionage and cyber crime operation APT41. Retrieved September 23, 2019.

    Open source URL
  7. [7]
    Sensocode

    (Citation: Talos ZxShell Oct 2014)

  8. [8]
    Sensocode

    (Citation: Talos ZxShell Oct 2014)

  9. [9]
    Sensocode

    (Citation: Talos ZxShell Oct 2014)

  10. [10]
    Talos ZxShell Oct 2014

    Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019.

    Open source URL
  11. [11]
    Talos ZxShell Oct 2014

    Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019.

    Open source URL
  12. [12]
    ZxShell

    (Citation: FireEye APT41 Aug 2019)(Citation: Talos ZxShell Oct 2014)

  13. [13]
    ZxShell

    (Citation: FireEye APT41 Aug 2019)(Citation: Talos ZxShell Oct 2014)

  14. [14]
    ZxShell

    (Citation: FireEye APT41 Aug 2019)(Citation: Talos ZxShell Oct 2014)

  15. [15]
    mitre-attackS0412
    Open source URL
  16. [16]
    mitre-attackS0412
    Open source URL
  17. [17]
    mitre-attackS0412
    Open source URL
  18. [18]
    Cisco Group 72

    Esler, J., Lee, M., and Williams, C. (2014, October 14). Threat Spotlight: Group 72. Retrieved January 14, 2016.

  19. [19]
    Talos ZxShell Oct 2014

    Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019.

    Open source URL
  20. [20]
    Talos ZxShell Oct 2014

    Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019.

    Open source URL
  21. [21]
    Talos ZxShell Oct 2014

    Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019.

    Open source URL
  22. [22]
    Talos ZxShell Oct 2014

    Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019.

    Open source URL
  23. [23]
    Talos ZxShell Oct 2014

    Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019.

    Open source URL
  24. [24]
    Talos ZxShell Oct 2014

    Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019.

    Open source URL
  25. [25]
    FireEye APT41 Aug 2019

    Fraser, N., et al. (2019, August 7). Double DragonAPT41, a dual espionage and cyber crime operation APT41. Retrieved September 23, 2019.

    Open source URL
  26. [26]
    FireEye APT41 Aug 2019

    Fraser, N., et al. (2019, August 7). Double DragonAPT41, a dual espionage and cyber crime operation APT41. Retrieved September 23, 2019.

    Open source URL
  27. [27]
    Talos ZxShell Oct 2014

    Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019.

    Open source URL
  28. [28]
    Talos ZxShell Oct 2014

    Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019.

    Open source URL
  29. [29]
    Talos ZxShell Oct 2014

    Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019.

    Open source URL
  30. [30]
    Talos ZxShell Oct 2014

    Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019.

    Open source URL
  31. [31]
    Talos ZxShell Oct 2014

    Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019.

    Open source URL
  32. [32]
    Talos ZxShell Oct 2014

    Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019.

    Open source URL
  33. [33]
    Talos ZxShell Oct 2014

    Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019.

    Open source URL
  34. [34]
    Talos ZxShell Oct 2014

    Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019.

    Open source URL
  35. [35]
    Talos ZxShell Oct 2014

    Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019.

    Open source URL
  36. [36]
    Talos ZxShell Oct 2014

    Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019.

    Open source URL
  37. [37]
    FireEye APT41 Aug 2019

    Fraser, N., et al. (2019, August 7). Double DragonAPT41, a dual espionage and cyber crime operation APT41. Retrieved September 23, 2019.

    Open source URL
  38. [38]
    FireEye APT41 Aug 2019

    Fraser, N., et al. (2019, August 7). Double DragonAPT41, a dual espionage and cyber crime operation APT41. Retrieved September 23, 2019.

    Open source URL
  39. [39]
    FireEye APT41 Aug 2019

    Fraser, N., et al. (2019, August 7). Double DragonAPT41, a dual espionage and cyber crime operation APT41. Retrieved September 23, 2019.

    Open source URL
  40. [40]
    FireEye APT41 Aug 2019

    Fraser, N., et al. (2019, August 7). Double DragonAPT41, a dual espionage and cyber crime operation APT41. Retrieved September 23, 2019.

    Open source URL
  41. [41]
    Talos ZxShell Oct 2014

    Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019.

    Open source URL
  42. [42]
    Talos ZxShell Oct 2014

    Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019.

    Open source URL
  43. [43]
    Talos ZxShell Oct 2014

    Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019.

    Open source URL
  44. [44]
    Talos ZxShell Oct 2014

    Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019.

    Open source URL
  45. [45]
    Talos ZxShell Oct 2014

    Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019.

    Open source URL
  46. [46]
    Talos ZxShell Oct 2014

    Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019.

    Open source URL
  47. [47]
    Talos ZxShell Oct 2014

    Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019.

    Open source URL
  48. [48]
    Talos ZxShell Oct 2014

    Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019.

    Open source URL
  49. [49]
    Talos ZxShell Oct 2014

    Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019.

    Open source URL
  50. [50]
    Talos ZxShell Oct 2014

    Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019.

    Open source URL
  51. [51]
    FireEye APT41 Aug 2019

    Fraser, N., et al. (2019, August 7). Double DragonAPT41, a dual espionage and cyber crime operation APT41. Retrieved September 23, 2019.

    Open source URL
  52. [52]
    FireEye APT41 Aug 2019

    Fraser, N., et al. (2019, August 7). Double DragonAPT41, a dual espionage and cyber crime operation APT41. Retrieved September 23, 2019.

    Open source URL
  53. [53]
    Talos ZxShell Oct 2014

    Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019.

    Open source URL
  54. [54]
    Talos ZxShell Oct 2014

    Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019.

    Open source URL
  55. [55]
    Talos ZxShell Oct 2014

    Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019.

    Open source URL
  56. [56]
    Talos ZxShell Oct 2014

    Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019.

    Open source URL
  57. [57]
    FireEye APT41 Aug 2019

    Fraser, N., et al. (2019, August 7). Double DragonAPT41, a dual espionage and cyber crime operation APT41. Retrieved September 23, 2019.

    Open source URL
  58. [58]
    FireEye APT41 Aug 2019

    Fraser, N., et al. (2019, August 7). Double DragonAPT41, a dual espionage and cyber crime operation APT41. Retrieved September 23, 2019.

    Open source URL
  59. [59]
    Talos ZxShell Oct 2014

    Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019.

    Open source URL
  60. [60]
    Talos ZxShell Oct 2014

    Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019.

    Open source URL
  61. [61]
    Talos ZxShell Oct 2014

    Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019.

    Open source URL
  62. [62]
    Talos ZxShell Oct 2014

    Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019.

    Open source URL
  63. [63]
    Talos ZxShell Oct 2014

    Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019.

    Open source URL
  64. [64]
    Talos ZxShell Oct 2014

    Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019.

    Open source URL
  65. [65]
    Talos ZxShell Oct 2014

    Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019.

    Open source URL
  66. [66]
    Talos ZxShell Oct 2014

    Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019.

    Open source URL
  67. [67]
    Talos ZxShell Oct 2014

    Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019.

    Open source URL
  68. [68]
    Talos ZxShell Oct 2014

    Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019.

    Open source URL
  69. [69]
    FireEye APT41 Aug 2019

    Fraser, N., et al. (2019, August 7). Double DragonAPT41, a dual espionage and cyber crime operation APT41. Retrieved September 23, 2019.

    Open source URL
  70. [70]
    FireEye APT41 Aug 2019

    Fraser, N., et al. (2019, August 7). Double DragonAPT41, a dual espionage and cyber crime operation APT41. Retrieved September 23, 2019.

    Open source URL
  71. [71]
    Secureworks BRONZEUNION Feb 2019

    Counter Threat Unit Research Team. (2019, February 27). A Peek into BRONZE UNION’s Toolbox. Retrieved September 24, 2019.

    Open source URL
  72. [72]
    Talos ZxShell Oct 2014

    Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019.

    Open source URL
  73. [73]
    Talos ZxShell Oct 2014

    Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019.

    Open source URL
  74. [74]
    Talos ZxShell Oct 2014

    Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019.

    Open source URL
  75. [75]
    Talos ZxShell Oct 2014

    Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019.

    Open source URL
  76. [76]
    Secureworks BRONZEUNION Feb 2019

    Counter Threat Unit Research Team. (2019, February 27). A Peek into BRONZE UNION’s Toolbox. Retrieved September 24, 2019.

    Open source URL
  77. [77]
    Secureworks BRONZEUNION Feb 2019

    Counter Threat Unit Research Team. (2019, February 27). A Peek into BRONZE UNION’s Toolbox. Retrieved September 24, 2019.

    Open source URL
  78. [78]
    Talos ZxShell Oct 2014

    Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019.

    Open source URL
  79. [79]
    Talos ZxShell Oct 2014

    Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019.

    Open source URL
  80. [80]
    Talos ZxShell Oct 2014

    Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019.

    Open source URL
  81. [81]
    Talos ZxShell Oct 2014

    Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019.

    Open source URL
  82. [82]
    Talos ZxShell Oct 2014

    Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019.

    Open source URL
  83. [83]
    Talos ZxShell Oct 2014

    Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019.

    Open source URL
  84. [84]
    Talos ZxShell Oct 2014

    Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019.

    Open source URL
  85. [85]
    Talos ZxShell Oct 2014

    Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019.

    Open source URL
  86. [86]
    Talos ZxShell Oct 2014

    Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019.

    Open source URL
  87. [87]
    Talos ZxShell Oct 2014

    Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019.

    Open source URL
  88. [88]
    FireEye APT41 Aug 2019

    Fraser, N., et al. (2019, August 7). Double DragonAPT41, a dual espionage and cyber crime operation APT41. Retrieved September 23, 2019.

    Open source URL
  89. [89]
    Talos ZxShell Oct 2014

    Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019.

    Open source URL
  90. [90]
    Talos ZxShell Oct 2014

    Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019.

    Open source URL
  91. [91]
    Talos ZxShell Oct 2014

    Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019.

    Open source URL
  92. [92]
    FireEye APT41 Aug 2019

    Fraser, N., et al. (2019, August 7). Double DragonAPT41, a dual espionage and cyber crime operation APT41. Retrieved September 23, 2019.

    Open source URL
  93. [93]
    Talos ZxShell Oct 2014

    Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019.

    Open source URL
  94. [94]
    Talos ZxShell Oct 2014

    Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019.

    Open source URL
  95. [95]
    Talos ZxShell Oct 2014

    Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use