Mo' Shells Mo' Problems - Deep Panda Web Shells | CrowdStrike

CrowdStrike's "Mo' Shells Mo' Problems" (Part 1) examines two web shells deployed by the China-linked APT Deep Panda: a minimal 28-byte ASP backdoor that executes VBScript from an HTTP parameter, and a robust ASP.NET (system_web.aspx) backdoor that uses covert authentication (cookies and specific HTTP headers), provides extensive file, SQL, Active Directory, and code-execution capabilities, and was used as a stealthy primary access vector; the report includes sample code, interface screenshots, command descriptions, and IOCs to aid detection and remediation.