Weevely | Netskope Threat Labs

Description

Weevely is an open source web shell generator and terminal that provides stealthy remote control of a compromised web server over HTTP. Penetration testers use it in authorized assessments, and cyberattackers use it to operate backdoors planted on servers they have compromised.

Stats

First seen: January 2023
Last seen: October 2026

Also known as

WeevelyShell

Alert name variants

Alert Name	Engine
Generic.Linux.Weevely.A.6D1AFF1C	AV
Generic.Linux.Weevely.A.76FD02F6	AV
Generic.Linux.Weevely.A.C0E6D50C	AV
Generic.Linux.Weevely.A.CF17E331	AV
Script-PHP.Backdoor.WeevelyShell	ATP Sandbox Adv. Heuristics
Script-Python.Hacktool.WeevelyShell	ATP Sandbox Adv. Heuristics
Trojan.PHP.Weevely.1	AV
Win32.Backdoor.WeevelyShell	ATP Sandbox Adv. Heuristics

Related IPS Signatures

Signature Name	Engine
MALWARE-CNC Generic.Weevely.Webshell traffic detected	IPS-SWG
MALWARE-CNC Weevely.c2.Payload traffic detected	IPS-SWG