reGeorg

Malware & Tools · reGeorg

· MalwareS1187 · Zararlı Yazılım

Type

malware

Techniques

Used By

3 groups

Platforms

Network Devices, Windows, macOS, Linux

Description

reGeorg is an open-source web shell written in Python that can be used as a proxy to bypass firewall rules and tunnel data in and out of targeted networks.(Citation: Fortinet reGeorg MAR 2019)(Citation: GitHub reGeorg 2016)

Tactic Coverage

command and control (5)lateral movement (3)execution (1)persistence (1)

Used By (3 groups)

G0007APT28IRON TWILIGHT, SNAKEMACKEREL G0016APT29IRON RITUAL, IRON HEMLOCK G1003Ember BearUNC2589, Bleeding Bear

Techniques (10)

T1021.001Remote Desktop Protocol

lateral movement

T1021.002SMB/Windows Admin Shares

lateral movement

T1021.004SSH

lateral movement

T1059.006Python

execution

T1071.001Web Protocols

command and control

T1090Proxy

command and control

T1095Non-Application Layer Protocol

References

https://attack.mitre.org/software/S1187 https://www.fortiguard.com/encyclopedia/ips/47584/regeorg-http-tunnel https://github.com/xl7dev/WebShell/tree/master/reGeorg-master