Top Tweets for #VShell
Pivoted further using @modat_magnify and found 16 active VShell panels across 13 IPs. All serving the same Chinese-language login page.
IOC thread π§΅
#ThreatIntel #C2 #VShell
VShell C2 (v4.9.3) panel identified.
VShell is a cross-platform post-exploitation framework popular with Mandarin-speaking threat actors.
WebSocket connection found in the panel: wss://www.haiwoi[.]top/api/v2/sync
IOC: https://t.co/JPHLc6jaNN
#ThreatIntel #C2 #VShell
![C2HuntersLabs's tweet photo. VShell C2 (v4.9.3) panel identified.
VShell is a cross-platform post-exploitation framework popular with Mandarin-speaking threat actors.
WebSocket connection found in the panel: wss://www.haiwoi[.]top/api/v2/sync
IOC: https://t.co/JPHLc6jaNN
#ThreatIntel #C2 #VShell https://t.co/nKMjGhFVpC](https://pbs.twimg.com/media/HU7hK0hagAEbAIh.jpg)
VShell C2 (v4.9.3) panel identified.
VShell is a cross-platform post-exploitation framework popular with Mandarin-speaking threat actors.
WebSocket connection found in the panel: wss://www.haiwoi[.]top/api/v2/sync
IOC: https://t.co/JPHLc6jaNN
#ThreatIntel #C2 #VShell
UNK_MassTraction, a suspected China-aligned actor, exploits Roundcube webmail flaws to steal credentials and deploy the VShell backdoor at universities.
#UNKMassTraction #Roundcube #VShell #CyberEspionage #Proofpoint #InfoSec
https://t.co/QuRORzhWUb
aaf4ccceca88bb874b8db6c30162c6ce13a3d5bf84fb5a2bcf61270445eef3e9
LNK > VBS > DLL side-loading > #SNOWLIGHT (#VShell Stager)
Fisher-Yates shuffling of shellcode with constant seed for rand()
C2: dns1.alidoh[.]com
h/t @malwrhunterteam
![G60930953's tweet photo. aaf4ccceca88bb874b8db6c30162c6ce13a3d5bf84fb5a2bcf61270445eef3e9
LNK > VBS > DLL side-loading > #SNOWLIGHT (#VShell Stager)
Fisher-Yates shuffling of shellcode with constant seed for rand()
C2: dns1.alidoh[.]com
h/t @malwrhunterteam https://t.co/wpxQgoSzGH](https://pbs.twimg.com/media/HIjhxMcWYAA12KT.png)
![G60930953's tweet photo. aaf4ccceca88bb874b8db6c30162c6ce13a3d5bf84fb5a2bcf61270445eef3e9
LNK > VBS > DLL side-loading > #SNOWLIGHT (#VShell Stager)
Fisher-Yates shuffling of shellcode with constant seed for rand()
C2: dns1.alidoh[.]com
h/t @malwrhunterteam https://t.co/wpxQgoSzGH](https://pbs.twimg.com/media/HIjhwn9XgAAhci7.png)
![G60930953's tweet photo. aaf4ccceca88bb874b8db6c30162c6ce13a3d5bf84fb5a2bcf61270445eef3e9
LNK > VBS > DLL side-loading > #SNOWLIGHT (#VShell Stager)
Fisher-Yates shuffling of shellcode with constant seed for rand()
C2: dns1.alidoh[.]com
h/t @malwrhunterteam https://t.co/wpxQgoSzGH](https://pbs.twimg.com/media/HIjhwAKXMAAs688.png)
![G60930953's tweet photo. aaf4ccceca88bb874b8db6c30162c6ce13a3d5bf84fb5a2bcf61270445eef3e9
LNK > VBS > DLL side-loading > #SNOWLIGHT (#VShell Stager)
Fisher-Yates shuffling of shellcode with constant seed for rand()
C2: dns1.alidoh[.]com
h/t @malwrhunterteam https://t.co/wpxQgoSzGH](https://pbs.twimg.com/media/HIjhvJfXEAAjYYo.png)
Presented our research at #AVAR2025 in Malaysia w/@ElementalX2 on Operation DRAGONCLONE, an activity attributed to a Chinese APT "government-led" red-team exercise
Thanks to @avar_asia for an excellent conference in Kuala Lumpur & connecting like minded folks!
#VELETRIX #VShell
New Research!
https://t.co/PLEygl5W3h
We have found an interesting campaign targeting an entity of Chinese telecom with VELETRIX implant. The implant uses anti-sandbox, shellcode obfuscation technique via IPV4 and execution via EnumCalendarInfo leading to Vshell implant.
Last Seen Hashtags on Sotwe
maestrahot
Seen from Chile
ιε
Seen from Japan
ngintip tidur
Seen from United States
ΩΨΆΨ§ΩΨ_ΨΉΨ±Ψ§ΩΩ
retweet
Seen from Vietnam
incestohijapapΓ‘
Seen from United States
mexican
Seen from United States
breathplay #kigurumi
Seen from Netherlands
pmv
Seen from South Africa
νλ
체λ²νλ¬Έ
Seen from Korea
Trends for you
Most Popular Users
Elon Musk 
@elonmusk
241.5M followers
Barack Obama
@barackobama
118.8M followers
Cristiano Ronaldo
@cristiano
114.5M followers
Donald J. Trump
@realdonaldtrump
111.8M followers
Narendra Modi
@narendramodi
107.1M followers
Rihanna
@rihanna
98.7M followers
NASA
@nasa
92.3M followers
Justin Bieber
@justinbieber
91.8M followers
KATY PERRY
@katyperry
90M followers
Taylor Swift
@taylorswift13
84M followers
Lady Gaga
@ladygaga
75.5M followers
Virat Kohli
@imvkohli
73.5M followers
Kim Kardashian
@kimkardashian
70.9M followers
YouTube
@youtube
68.8M followers
Neymar Jr
@neymarjr
66.5M followers
Bill Gates
@billgates
65.3M followers
Selena Gomez
@selenagomez
63.1M followers
The Ellen Show
@theellenshow
62.2M followers
CNN
@cnn
61.7M followers
X
@x
60.7M followers