Godzilla

Godzilla is a potent malware that allows attackers to remotely control compromised servers, execute arbitrary commands, upload and download files, manipulate databases, and perform other malicious activities. The malware was linked to a group known as Ethereal Panda by CrowdStrike due to their similar tactics, techniques, and procedures (TTPs), including the use of Godzilla as an open-source webshell. Multiple hacktivist groups, such as Skynet, Godzilla, and Anonymous Sudan, have claimed responsibility for various incidents involving this malware. The Godzilla malware gained notoriety in March 2024 when hackers exploited a vulnerability in the WordPress Plugin 3DPrint Lite (CVE-2021-4436) to deploy it. Cybercriminals often exploit vulnerabilities in popular software, such as WordPress plugins, to gain unauthorized access and carry out their nefarious activities. Attacks against Confluence notably utilized the infamous Godzilla Web shell, further solidifying its reputation in the cybersecurity community. In addition to its initial capabilities, the attackers have continued to enhance the sophistication of the bot and its operation. This includes the introduction of an intermediary loader, known as the Godzilla Loader, and obfuscation of key elements in the binary. The payload distributed by Godzilla Loader has been used in multiple campaigns to distribute other malware like Dridex, Trickbot, and Panda Banker, indicating a high degree of adaptability and threat.