Netskope Threat Labs

BlueShell

ATP Sandbox Adv. HeuristicsNetskope IPS

BlueShell is a backdoor written in Go that supports Windows, Linux, and macOS systems, with its source originally published on GitHub and still available through other repositories. Its developers wrote the documentation in Chinese, which researchers cite as an indicator of the developer's origin.

First seen
September 2023
Last seen
October 2026
Blueshell
Alert Name
Linux.Ransomware.BlueShell
Linux.Trojan.Blueshell
Linux.Trojan.BlueShell
Win32.Trojan.BlueShell
Win64.Trojan.BlueShell