Inside the Web Shell Used in the Microsoft Exchange Server Attacks

China Chopper Web shells are an older threat causing new problems for many organizations targeted in ongoing attacks against vulnerable Microsoft Exchange Servers worldwide.

Since Microsoft patched a series of Exchange Server zero-days on March 2, what had previously been "limited and targeted" attacks quickly became a global issue as attackers weaponized the critical flaws. Security companies tracking the activity, including FireEye and Red Canary, noticed China Chopper Web shells played a consistent role in their observed attack patterns.

Less than two weeks after the flaws were disclosed, the DHS' Cybersecurity and Infrastructure Security Agency (CISA) updated its guidance on the vulnerabilities to include seven China Chopper Web shells connected to successful attacks against vulnerable Exchange Servers.

China Chopper is not a new piece of malware. Researchers with FireEye first published research on the threat in 2013; Cisco Talos experts have dated samples back to 2010. It's a fairly simple backdoor that allows criminals to remotely access a target network and gain remote control.

A Web shell typically has client-side and server-side parts. China Chopper has a command-and-control (C2) binary, and a text-based Web shell payload that acts as the server component. As FireEye researchers note in an early report on the threat, this text-based payload is so simple that an attacker could type it by hand on a target server without the need for a file transfer.

"[It] was notable at the time because it was much smaller than some of the other Web shells that were commonly used and it still had a full set of features," says Ben Read, director of cyber espionage analysis at Mandiant. "Because it was smaller and more succinctly written, it was at the time picked up by fewer antiviruses."

There are several ways China Chopper may get onto a target network. Some attackers employ zero-days, as seen in the Exchange Server attacks, but more often they target old versions of software running on Web-facing servers. This often includes website administration software, VPN servers, or email, he notes.

From there, it's a small but powerful post-exploitation tool. Once on a target, China Chopper can be used to remotely execute operating system commands and conduct activities such as uploading and executing additional tools, pivoting to other systems, and exfiltrating data. It can check out where the server is, what it's connected to, and where to pivot within the network.

"It's less of a specific functionality that it has, than it enables full access to the machine and then the attacker can do what they want," Read explains. Web shells work best when they're on an Internet-facing server because the attacker can directly call out to it. A backdoor, in contrast, usually initiates a callout from the point on the corporate network where it resides.

Web servers and Exchange Servers are appealing targets because, as he notes, they're less likely to run antivirus or endpoint detection and response (EDR) tools. "You should – it's a best practice, but it is not uncommon for there not to be one," Read adds. There's less of an arms race to avoid antivirus tools in Web shells because the tools aren't as frequently deployed.

China Chopper appeals to attackers because it's easy to use but difficult to detect, explains Aviad Hasnis, CTO of Cynet. Its lightweight nature helps attackers fly under the radar and avoid detection.

"The back end of it, the command-and-control part, is very straightforward," he says. "It has a graphical interface [and] it supports different types of programming languages, whether the Web shell is in PHP or ASP or Jscript." The GUI allows the attacker to conduct activity with a point-and-click interface, as well as a command line screen.

A Global Attacker Favorite

China Chopper's stealth and simplicity has made it an attacker tool used around the world.

In its early days, the Web shell was heavily used by Chinese groups believed to operate in support of China's government. By now it's no longer unique to Chinese nation-state groups, yet while they do continue to use China Chopper, it's now traded among global attackers – both advanced and less-skilled actors use it.

"We've seen [it] in recent activities utilizing infrastructure located on US soil, but still there are widespread targets from the Middle East, to the far East, to Western and Eastern Europe, and of course in the United States, it's a global operation," says Shiran Grinberg, CyOps manager at Cynet. There is no specific country or continent targeted with the China Chopper Web shell.

Cynet has observed several advanced groups using China Chopper including Calypso, APT27, APT41, SoftCell, Leviathan, BronzeButler, and Tonto Team, among others. Grinberg notes that there has been additional use of China Chopper that hasn't been connected to a specific group. Cynet's data indicates much of its activity is focused on the finance and energy sectors but isn't limited to those industries.

Its widespread nature makes China Chopper an ideal fit for the widespread Microsoft Exchange Server attacks. An attacker targeting thousands of machines will inevitably be caught; as a result, they don't want to use a capability that people don't know about or that they want to remain secret. There is a greater likelihood a common Web shell like China Chopper will be detected than a novel one; however, the attack group isn't wasting a hidden novel capability.

For all the years it has been in use, the China Chopper Web shell has remained largely unchanged, says Vanja Svajcer, threat researcher with Cisco Talos, who says it's not unusual for a Web shell to be in use for this amount of time.

"There have been modifications of its client to make its use easier for attackers but very little has changed on the server side," he says. "The server simply receives executable code from the client component and this executable code is interpreted by the executing environment, PHP or .NET ASP."

Most of the changes that have been made to China Chopper are intended to better conceal it, Read notes. While its functionality has remained the same, attackers may put wrappers around it or encode it to evade detection by security tools.