Netskope Threat Labs

ZxShell

ATP Sandbox Adv. Heuristics

Stats

First seen
April 2022
Last seen
October 2026

MITRE ATT&CK techniques

34 techniques across 10 tactics.

TA0001 Initial Access

  • T1190Exploit Public-Facing Application

TA0002 Execution

TA0003 Persistence

TA0005 Stealth

TA0007 Discovery

  • T1007System Service Discovery
  • T1012Query Registry
  • T1033System Owner/User Discovery
  • T1046Network Service Discovery
  • T1057Process Discovery
  • T1082System Information Discovery
  • T1083File and Directory Discovery

TA0008 Lateral Movement

TA0009 Collection

TA0011 Command and Control

TA0040 Impact

  • T1499Endpoint Denial of Service

TA0112 Defense Impairment

Associated groups

Alert name variants

Alert Name
Win32.Backdoor.ZxShell
Win32.Trojan.ZxShell
Win64.Trojan.ZxShell

Related families

InvisiMoleCobalt StrikeEmpirenjRATPlugX