Netskope Threat Labs

C99Shell

ATP Sandbox Adv. HeuristicsAV

C99Shell is a PHP-based web shell that provides remote command execution, file browsing, and file upload capabilities on compromised web servers.

First seen
June 2022
Last seen
September 2026
C99shell
Alert Name
Backdoor.C99shell.S
Backdoor.PHP.C99Shell.AE
Backdoor.PHP.C99Shell.AQ
Backdoor.PHP.C99Shell.BA
Backdoor.PHP.C99Shell.BG
Backdoor.PHP.C99Shell.BK
Backdoor.PHP.C99Shell.P
Backdoor.PHP.C99Shell.Q
Generic.C99Shell.1A1C024B
Generic.C99Shell.26FAD757