BlackMould

Executive Summary

BlackMould is a China Chopper–based web shell that compromises Microsoft IIS servers to enable remote execution, data exfiltration, and persistence. Reported in late 2019, it was used by the GALLIUM group against telecom operators, indicating a high‑profile targeted campaign. The shell embeds PHP/ASP routines that can be manipulated via browser URLs, allowing attackers to download, upload, and execute code, making it a potent foothold for further attacks. Defenders must monitor IIS logs for anomalous requests, scan web directories for unknown scripts, and enforce strict file‑type restrictions to prevent deployment.

BlackMould is a web‑shell malware that builds on the China Chopper framework and targets servers running Microsoft IIS on Windows platforms. First reported by Microsoft in December 2019, it has been linked to the GALLIUM threat group, which used it to compromise telecommunications providers across several regions. The web shell allows attackers to interact with the compromised host through a browser‑based command interface, providing the ability to execute arbitrary system commands, upload and download files, modify web content, and establish persistence on the victim server. Once installed, BlackMould typically drops a set of PHP or ASP scripts into existing web directories, disguising its presence as legitimate application files. These scripts can be accessed via obscured URLs that evade basic file‑type filtering. The shell also supports keylogging and credential harvesting by injecting scripts into targeted web pages. In campaigns directed at telecom operators, attackers used the shell to exfiltrate configuration data, service logs, and network topologies. Its China Chopper heritage means that it frequently leverages encoded payloads and encryption routines to obfuscate its traffic and reduce detection rates. Defenders should treat BlackMould as a high‑severity threat: it can transform a web server into an attack platform for broader lateral movement and data exfiltration. Identifying the presence of this shell involves scrutinizing IIS logs for anomalous POST requests, analyzing uploaded files for obfuscated PHP/ASP code patterns, and monitoring outbound traffic to unusual command servers or public cloud storage providers. Mitigation requires strict access controls on web directories, regular scanning for unknown scripts, and hardening of IIS configurations against common web‑shell vectors.

Key Capabilities

• Deploys PHP/ASP web shell onto IIS servers
• Provides browser‑based command execution interface
• Uploads and downloads files to/from compromised host
• Powers remote command execution via encoded payloads
• Obfuscates traffic using encryption or encoding techniques
• Allows persistence through scheduled tasks or hidden directory entries

ATT&CK Techniques

Recommended Actions

• Inspect IIS logs for irregular POST/GET requests and hidden script URLs
• Run signature‑based scans on web directories for known China Chopper code patterns
• Restrict file permissions to allow only trusted binaries in public web folders
• Deploy a Web Application Firewall (WAF) to filter suspicious input and block known web‑shell signatures
• Implement network segmentation so that compromised servers cannot reach core telecommunication infrastructure
• Set up alerting on outbound traffic to unfamiliar IP addresses or cloud storage endpoints

Suggested Tags