Top Tweets for #vshell
Pivoted further using @modat_magnify and found 16 active VShell panels across 13 IPs. All serving the same Chinese-language login page.
IOC thread π§΅
#ThreatIntel #C2 #VShell
VShell C2 (v4.9.3) panel identified.
VShell is a cross-platform post-exploitation framework popular with Mandarin-speaking threat actors.
WebSocket connection found in the panel: wss://www.haiwoi[.]top/api/v2/sync
IOC: https://t.co/JPHLc6jaNN
#ThreatIntel #C2 #VShell
![C2HuntersLabs's tweet photo. VShell C2 (v4.9.3) panel identified.
VShell is a cross-platform post-exploitation framework popular with Mandarin-speaking threat actors.
WebSocket connection found in the panel: wss://www.haiwoi[.]top/api/v2/sync
IOC: https://t.co/JPHLc6jaNN
#ThreatIntel #C2 #VShell https://t.co/nKMjGhFVpC](https://pbs.twimg.com/media/HU7hK0hagAEbAIh.jpg)
VShell C2 (v4.9.3) panel identified.
VShell is a cross-platform post-exploitation framework popular with Mandarin-speaking threat actors.
WebSocket connection found in the panel: wss://www.haiwoi[.]top/api/v2/sync
IOC: https://t.co/JPHLc6jaNN
#ThreatIntel #C2 #VShell
UNK_MassTraction, a suspected China-aligned actor, exploits Roundcube webmail flaws to steal credentials and deploy the VShell backdoor at universities.
#UNKMassTraction #Roundcube #VShell #CyberEspionage #Proofpoint #InfoSec
https://t.co/QuRORzhWUb
aaf4ccceca88bb874b8db6c30162c6ce13a3d5bf84fb5a2bcf61270445eef3e9
LNK > VBS > DLL side-loading > #SNOWLIGHT (#VShell Stager)
Fisher-Yates shuffling of shellcode with constant seed for rand()
C2: dns1.alidoh[.]com
h/t @malwrhunterteam
![G60930953's tweet photo. aaf4ccceca88bb874b8db6c30162c6ce13a3d5bf84fb5a2bcf61270445eef3e9
LNK > VBS > DLL side-loading > #SNOWLIGHT (#VShell Stager)
Fisher-Yates shuffling of shellcode with constant seed for rand()
C2: dns1.alidoh[.]com
h/t @malwrhunterteam https://t.co/wpxQgoSzGH](https://pbs.twimg.com/media/HIjhxMcWYAA12KT.png)
![G60930953's tweet photo. aaf4ccceca88bb874b8db6c30162c6ce13a3d5bf84fb5a2bcf61270445eef3e9
LNK > VBS > DLL side-loading > #SNOWLIGHT (#VShell Stager)
Fisher-Yates shuffling of shellcode with constant seed for rand()
C2: dns1.alidoh[.]com
h/t @malwrhunterteam https://t.co/wpxQgoSzGH](https://pbs.twimg.com/media/HIjhwn9XgAAhci7.png)
![G60930953's tweet photo. aaf4ccceca88bb874b8db6c30162c6ce13a3d5bf84fb5a2bcf61270445eef3e9
LNK > VBS > DLL side-loading > #SNOWLIGHT (#VShell Stager)
Fisher-Yates shuffling of shellcode with constant seed for rand()
C2: dns1.alidoh[.]com
h/t @malwrhunterteam https://t.co/wpxQgoSzGH](https://pbs.twimg.com/media/HIjhwAKXMAAs688.png)
![G60930953's tweet photo. aaf4ccceca88bb874b8db6c30162c6ce13a3d5bf84fb5a2bcf61270445eef3e9
LNK > VBS > DLL side-loading > #SNOWLIGHT (#VShell Stager)
Fisher-Yates shuffling of shellcode with constant seed for rand()
C2: dns1.alidoh[.]com
h/t @malwrhunterteam https://t.co/wpxQgoSzGH](https://pbs.twimg.com/media/HIjhvJfXEAAjYYo.png)
Presented our research at #AVAR2025 in Malaysia w/@ElementalX2 on Operation DRAGONCLONE, an activity attributed to a Chinese APT "government-led" red-team exercise
Thanks to @avar_asia for an excellent conference in Kuala Lumpur & connecting like minded folks!
#VELETRIX #VShell
New Research!
https://t.co/PLEygl5W3h
We have found an interesting campaign targeting an entity of Chinese telecom with VELETRIX implant. The implant uses anti-sandbox, shellcode obfuscation technique via IPV4 and execution via EnumCalendarInfo leading to Vshell implant.
Last Seen Hashtags on Sotwe
mgai()()()()()() filter:videos
Seen from United States
ΰΈͺΰΈ£ΰΈ£ΰΈΰΈΰΈΈΰΈ£ΰΈ΅
Seen from Thailand
chaquetrix
Seen from Brazil
teenagers
Seen from Turkey
ι
εΊε»ε
Seen from France
adolecente
Seen from United States
novinhodopirocΓ£o
momsonn (********--*******) filter:native_video
minichat() +filter:native_video
Seen from Netherlands
somno()*************
Seen from United States
Most Popular Users
Elon Musk 
@elonmusk
241.5M followers
Barack Obama
@barackobama
118.8M followers
Cristiano Ronaldo
@cristiano
114.5M followers
Donald J. Trump
@realdonaldtrump
111.8M followers
Narendra Modi
@narendramodi
107.1M followers
Rihanna
@rihanna
98.7M followers
NASA
@nasa
92.3M followers
Justin Bieber
@justinbieber
91.8M followers
KATY PERRY
@katyperry
90M followers
Taylor Swift
@taylorswift13
84M followers
Lady Gaga
@ladygaga
75.5M followers
Virat Kohli
@imvkohli
73.5M followers
Kim Kardashian
@kimkardashian
70.9M followers
YouTube
@youtube
68.8M followers
Neymar Jr
@neymarjr
66.5M followers
Bill Gates
@billgates
65.3M followers
Selena Gomez
@selenagomez
63.1M followers
The Ellen Show
@theellenshow
62.2M followers
CNN
@cnn
61.7M followers
X
@x
60.7M followers