ASPXSpy

ASPXSpy is a type of malware, specifically a web shell, that has been used by various threat actors to exploit and damage computer systems. The earliest deployment attempts date back to 2022 when this malicious software was deployed to multiple hosted websites. It's typically installed on vulnerable web servers of targeted organizations, often using stolen legitimate credentials to compromise externally facing resources such as Outlook Web Access (OWA). This allows threat actors to secure unauthorized access to web servers and carry out further attacks. The cybersecurity firm Volexity has observed numerous instances of ASPXSpy use, alongside other web shells like China Chopper variants and ANTAK. One specific instance involved the Gelsemium group, which reportedly employed one of the ASPXSpy web shells previously used by Iron Taurus (aka APT 27) for Operation Iron Tiger in 2015. This highlights the public availability and widespread use of this malware across different cyber-attack campaigns. The ASPXSpy web shell has also been prevalent in XeGroup’s attacks, demonstrating its widespread usage among different threat actors. In addition to exploiting vulnerabilities like CVE-2019-18935, XeGroup has been known to use ASPXSpy web shells to gain unauthorized access to web servers. The continued use of this web shell underscores the persistent threat it poses to organizations and emphasizes the need for robust cybersecurity measures to mitigate these risks.