Notable web shell incidents, from ProxyLogon to ToolShell

The same pattern recurs across the most significant intrusions of the past decade: an internet-facing system is exploited, a web shell (or web-based implant) is dropped for persistence, and the operators return — sometimes days, sometimes months later. This page summarises well-documented public cases. It relies on vendor advisories, government reports and published research, and focuses on the lessons for defenders rather than on attribution debates.

Timeline at a glance

Equifax (2017) — Apache Struts

Attackers exploited CVE-2017-5638, a remote code execution flaw in the Apache Struts framework's Jakarta Multipart parser, in an online dispute portal in 2017 — weeks after a patch was available. According to the US Government Accountability Office's report on the breach, the attackers installed web shells to maintain access and then ran queries over a period of months, exfiltrating data on roughly 147 million people. An expired certificate on a traffic-inspection device meant the exfiltration traffic went uninspected.

Lessons: patch framework vulnerabilities on internet-facing apps as emergencies; maintain an accurate inventory of where each framework is used; and ensure network monitoring controls are actually working.

Exchange ProxyLogon (2021)

In early March 2021, Microsoft released out-of-band updates for on-premises Exchange Server and attributed early exploitation to a group it calls HAFNIUM. The chain combined CVE-2021-26855 (a server-side request forgery allowing authentication bypass) with post-authentication flaws including CVE-2021-27065 (arbitrary file write). Attackers used it to write ASPX web shells — many resembling the long-known China Chopper model — into web-served Exchange and IIS directories, sometimes by abusing a virtual-directory configuration field to embed code.

Once the patches were public, multiple threat actors began mass exploitation, and large numbers of servers were backdoored before they were patched. In April 2021 the US Department of Justice announced a court-authorised operation in which the FBI removed web shells from hundreds of vulnerable Exchange servers in the United States whose owners had not done so.

Lessons: patching does not remove shells already planted; organisations needed file integrity sweeps and vendor-provided scanning tools after patching. Exchange directories such as aspnet_client and the OWA/ECP auth folders became standard hunt locations.

Exchange ProxyShell (2021)

ProxyShell was demonstrated at Pwn2Own in April 2021 and presented at Black Hat in August 2021. It chained CVE-2021-34473 (a path-confusion flaw enabling pre-authentication access to backend endpoints), CVE-2021-34523 (privilege elevation in the Exchange PowerShell backend) and CVE-2021-31207 (a post-authentication arbitrary file write). Attackers abused the mailbox export feature to write a file with an .aspx extension into a web-served directory, then used it as a web shell. Patches had shipped in the April and May 2021 cumulative updates, but many servers remained unpatched, and widespread exploitation followed in August 2021, including by ransomware operators.

Lessons: "arbitrary file write" vulnerabilities are web shell vulnerabilities; keep on-premises Exchange (or any complex internet-facing suite) on current cumulative updates; and monitor for worker processes spawning shells.

Citrix NetScaler ADC and Gateway (2023)

In July 2023 Citrix disclosed CVE-2023-3519, an unauthenticated remote code execution vulnerability in NetScaler ADC and Gateway. CISA reported that threat actors had exploited it as a zero-day in June 2023 to plant a web shell on a critical-infrastructure organisation's appliance, and later scanning by researchers identified many more appliances carrying web shells even after patching.

Lessons: edge appliances rarely run EDR, so vendor indicators, integrity checks and forensic imaging are the main detection tools; patching must be followed by a compromise assessment.

MOVEit Transfer (2023)

At the end of May 2023, Progress Software disclosed CVE-2023-34362, a SQL injection vulnerability in the MOVEit Transfer managed file-transfer application. The Cl0p extortion group exploited it at scale, deploying a custom ASP.NET web shell — tracked as LEMURLOOT and commonly observed under the file name human2.aspx, chosen to resemble the legitimate human.aspx — to access the database and steal files. The campaign affected a very large number of organisations, directly and through their service providers.

Lessons: attackers deliberately name shells after legitimate product files, so name-based review fails; a hash manifest of the vendor's files catches the difference immediately. Third-party and supplier exposure must be part of incident scoping.

Ivanti Connect Secure (2024)

In January 2024 Ivanti disclosed CVE-2023-46805 (authentication bypass) and CVE-2024-21887 (command injection) in Connect Secure and Policy Secure gateways, which were being chained in the wild. Researchers at Volexity and Mandiant reported that attackers modified legitimate appliance components to embed web shells and credential-harvesting implants, and attempted to tamper with the appliance's integrity checking tool. Ivanti and CISA advised running the external integrity checker and, where compromise was found, performing factory resets and credential rotation.

Lessons: on appliances, a web shell may be code injected into existing product files rather than a new file; rely on vendor integrity tools run from outside the device and treat any device exposed during the exploitation window as suspect.

SharePoint "ToolShell" (2025)

In July 2025, active exploitation of on-premises Microsoft SharePoint Server was reported, tracked as CVE-2025-53770 (a variant related to earlier CVE-2025-49704/49706 fixes) and dubbed "ToolShell". Researchers observed attackers dropping an ASPX file — widely reported as spinstall0.aspx in the SharePoint LAYOUTS directory — whose purpose was to extract the server's ASP.NET machine keys. With those keys, attackers could craft signed ViewState payloads to regain code execution at will, even after the file was removed. Microsoft's guidance included applying updates, enabling AMSI integration, and rotating machine keys and restarting IIS.

Lessons: a web shell may be a credential-theft tool rather than a command runner; eradication must include rotating any secret the shell could have read. See eradication and hardening.

Cross-cutting lessons

Primary sources worth bookmarking

• Microsoft Security Response Center and Microsoft Threat Intelligence blogs (Exchange 2021, SharePoint 2025).
• CISA advisories and the Known Exploited Vulnerabilities catalogue.
• NSA and Australian Signals Directorate, Detect and Prevent Web Shell Malware (2020).
• US GAO report on the Equifax data breach (2018).
• Vendor advisories from Citrix, Progress and Ivanti, and incident write-ups from Volexity, Mandiant and other responders.

Reading the original reports is worthwhile: each includes indicators and detection guidance that go beyond this summary.