ZypeerShell webshell adds GSocket C2 backdoor

Published22 June 2026 Vorant ratingroutine threat

Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

New PHP webshell ZypeerShell spotted in the wild with classic features plus hidden GSocket C2 backdoor capability and obfuscated deployment variant.

Sourceisc.sans.edu — open the original

What to check

Applies to: Whether this concerns you is not assessed; the names the report mentions are listed below.

Security researchers have identified ZypeerShell, a PHP webshell published on GitHub two months ago that markets itself as "the most powerful, undetectable, and feature-rich PHP webshell available." The shell provides standard webshell functionality but notably includes a hidden function (zypeergsdeploy) that connects to a command-and-control server via GSocket. This backdoor capability is present in the code but not accessible through the GUI, suggesting covert persistence mechanisms.

The webshell exists in both standard and obfuscated variants, with the latter using Fortress Layer multi-layer loading with integrity checks. ZypeerShell is being promoted as a red-team tool on Telegram channels. While webshells remain a persistent threat vector for maintaining access to compromised web servers, this particular variant's combination of standard administrative features and hidden C2 capability represents an evolution in post-exploitation tooling.

Organizations should monitor for ZypeerShell artifacts in web directories and review server logs for GSocket connections. The tool's availability on public repositories and promotion in offensive security communities suggests it will see adoption by both penetration testers and malicious actors.

Mentioned in this report

Malware ZypeerShell

Detection guidance

Web Server Process Spawning Command Shell (Possible Webshell Execution)

ATT&CK T1505.003 · status experimental · needs windows process_creation logs · generated from the report, not run against telemetry

A behavioural hunt for the technique in general.

Detects a web server or PHP interpreter process spawning a command shell, a common indicator of webshell-driven command execution such as ZypeerShell's admin/exec features. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Web Server Process Spawning Command Shell (Possible Webshell Execution)
id: 4e231f95-4cd8-59ca-aa39-dd6d5d51f5ff
status: experimental
description: Detects a web server or PHP-cgi/interpreter process spawning cmd.exe
  or PowerShell, a common indicator of webshell command execution such as ZypeerShell's
  built-in shell/exec features.
references:
- Vendor report on ZypeerShell webshell with hidden GSocket backdoor
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \\w3wp.exe
    - \\httpd.exe
    - \\nginx.exe
    - \\php-cgi.exe
    - \\php.exe
  spawn:
    Image|endswith:
    - \\cmd.exe
    - \\powershell.exe
    - \\pwsh.exe
  condition: selection and spawn
falsepositives:
- Legitimate CGI/administration scripts that invoke system utilities for diagnostics
- Custom web application health-check scripts that shell out to system commands
level: high
tags:
- attack.t1505.003
- attack.persistence
author: Vorant

DNS Resolution of GSocket Relay Domain from Web Server Process

ATT&CK T1071.001 · status experimental · needs windows dns_query logs · generated from the report, not run against telemetry

A behavioural hunt for the technique in general.

Detects a web server or PHP process resolving the gsocket.io relay domain, indicating a webshell such as ZypeerShell activating its hidden GSocket C2 backdoor. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: DNS Resolution of GSocket Relay Domain from Web Server Process
id: a914d47c-f42e-5ada-9b11-17bf23b201d9
status: experimental
description: Detects DNS queries to gsocket.io (the default GSocket relay domain)
  originating from a web server or PHP process, consistent with a compromised webshell
  activating a hidden GSocket-based C2 backdoor as seen with ZypeerShell.
references:
- Vendor report on ZypeerShell webshell with hidden GSocket backdoor
logsource:
  category: dns_query
  product: windows
detection:
  selection:
    Image|endswith:
    - \\w3wp.exe
    - \\httpd.exe
    - \\nginx.exe
    - \\php-cgi.exe
    - \\php.exe
    QueryName|contains: gsocket.io
  condition: selection
falsepositives:
- Authorized use of GSocket for legitimate remote administration or support tunnels
level: medium
tags:
- attack.t1071.001
- attack.command-and-control
author: Vorant

GSocket Client Binary Executed by Web Server Process

ATT&CK T1071.001 · status experimental · needs windows process_creation logs · generated from the report, not run against telemetry

A behavioural hunt for the technique in general.

Detects execution of the gs-netcat/gsocket client binary as a child process of a web server or PHP interpreter, indicating a webshell deploying a GSocket-based covert C2 channel (e.g., ZypeerShell's zypeergsdeploy function). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: GSocket Client Binary Executed by Web Server Process
id: b646548c-46d6-52ae-9bec-550224f25d29
status: experimental
description: Detects a gs-netcat/gsocket client binary being spawned by a web server
  or PHP process, consistent with a webshell (such as ZypeerShell) invoking its hidden
  GSocket deployment function to establish covert C2.
references:
- Vendor report on ZypeerShell webshell with hidden GSocket backdoor
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \\w3wp.exe
    - \\httpd.exe
    - \\nginx.exe
    - \\php-cgi.exe
    - \\php.exe
    Image|endswith:
    - \\gs-netcat.exe
    - \\gsocket.exe
  cli:
    CommandLine|contains:
    - gs-netcat
    - gsocket
  condition: selection or cli
falsepositives:
- Legitimate administrator-installed GSocket usage for remote support from a server
  context
level: high
tags:
- attack.t1071.001
- attack.t1505.003
- attack.command-and-control
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://isc.sans.edu/diary/rss/33096

Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.

What this brief leaves out

This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the malware it names. The paid plans add the security research and news reporting the free tier leaves out.

It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.

A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.

Create a free account What it costs