# ZypeerShell webshell adds GSocket C2 backdoor

Published: 2026-06-22 · Severity: medium
Canonical: https://vorant.io/reports/460b90a8-e64a-5943-b2ca-9a2b046c8cf5/zypeershell-webshell-adds-gsocket-c2-backdoor

> New PHP webshell ZypeerShell spotted in the wild with classic features plus hidden GSocket C2 backdoor capability and obfuscated deployment variant.

Security researchers have identified ZypeerShell, a PHP webshell published on GitHub two months ago that markets itself as "the most powerful, undetectable, and feature-rich PHP webshell available." The shell provides standard webshell functionality but notably includes a hidden function (zypeergsdeploy) that connects to a command-and-control server via GSocket. This backdoor capability is present in the code but not accessible through the GUI, suggesting covert persistence mechanisms.

The webshell exists in both standard and obfuscated variants, with the latter using Fortress Layer multi-layer loading with integrity checks. ZypeerShell is being promoted as a red-team tool on Telegram channels. While webshells remain a persistent threat vector for maintaining access to compromised web servers, this particular variant's combination of standard administrative features and hidden C2 capability represents an evolution in post-exploitation tooling.

Organizations should monitor for ZypeerShell artifacts in web directories and review server logs for GSocket connections. The tool's availability on public repositories and promotion in offensive security communities suggests it will see adoption by both penetration testers and malicious actors.

## Mentioned in this report

- Malware: ZypeerShell

## Detection guidance (public sample)

### Web Server Process Spawning Command Shell (Possible Webshell Execution)

ATT&CK: T1505.003

Detects a web server or PHP interpreter process spawning a command shell, a common indicator of webshell-driven command execution such as ZypeerShell's admin/exec features. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Web Server Process Spawning Command Shell (Possible Webshell Execution)
id: 4e231f95-4cd8-59ca-aa39-dd6d5d51f5ff
status: experimental
description: Detects a web server or PHP-cgi/interpreter process spawning cmd.exe
  or PowerShell, a common indicator of webshell command execution such as ZypeerShell's
  built-in shell/exec features.
references:
- Vendor report on ZypeerShell webshell with hidden GSocket backdoor
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \\w3wp.exe
    - \\httpd.exe
    - \\nginx.exe
    - \\php-cgi.exe
    - \\php.exe
  spawn:
    Image|endswith:
    - \\cmd.exe
    - \\powershell.exe
    - \\pwsh.exe
  condition: selection and spawn
falsepositives:
- Legitimate CGI/administration scripts that invoke system utilities for diagnostics
- Custom web application health-check scripts that shell out to system commands
level: high
tags:
- attack.t1505.003
- attack.persistence
author: Vorant
```

### DNS Resolution of GSocket Relay Domain from Web Server Process

ATT&CK: T1071.001

Detects a web server or PHP process resolving the gsocket.io relay domain, indicating a webshell such as ZypeerShell activating its hidden GSocket C2 backdoor. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: DNS Resolution of GSocket Relay Domain from Web Server Process
id: a914d47c-f42e-5ada-9b11-17bf23b201d9
status: experimental
description: Detects DNS queries to gsocket.io (the default GSocket relay domain)
  originating from a web server or PHP process, consistent with a compromised webshell
  activating a hidden GSocket-based C2 backdoor as seen with ZypeerShell.
references:
- Vendor report on ZypeerShell webshell with hidden GSocket backdoor
logsource:
  category: dns_query
  product: windows
detection:
  selection:
    Image|endswith:
    - \\w3wp.exe
    - \\httpd.exe
    - \\nginx.exe
    - \\php-cgi.exe
    - \\php.exe
    QueryName|contains: gsocket.io
  condition: selection
falsepositives:
- Authorized use of GSocket for legitimate remote administration or support tunnels
level: medium
tags:
- attack.t1071.001
- attack.command_and_control
author: Vorant
```

### GSocket Client Binary Executed by Web Server Process

ATT&CK: T1071.001

Detects execution of the gs-netcat/gsocket client binary as a child process of a web server or PHP interpreter, indicating a webshell deploying a GSocket-based covert C2 channel (e.g., ZypeerShell's zypeergsdeploy function). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: GSocket Client Binary Executed by Web Server Process
id: b646548c-46d6-52ae-9bec-550224f25d29
status: experimental
description: Detects a gs-netcat/gsocket client binary being spawned by a web server
  or PHP process, consistent with a webshell (such as ZypeerShell) invoking its hidden
  GSocket deployment function to establish covert C2.
references:
- Vendor report on ZypeerShell webshell with hidden GSocket backdoor
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \\w3wp.exe
    - \\httpd.exe
    - \\nginx.exe
    - \\php-cgi.exe
    - \\php.exe
    Image|endswith:
    - \\gs-netcat.exe
    - \\gsocket.exe
  cli:
    CommandLine|contains:
    - gs-netcat
    - gsocket
  condition: selection or cli
falsepositives:
- Legitimate administrator-installed GSocket usage for remote support from a server
  context
level: high
tags:
- attack.t1071.001
- attack.t1505.003
- attack.command_and_control
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://isc.sans.edu/diary/rss/33096

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/460b90a8-e64a-5943-b2ca-9a2b046c8cf5/zypeershell-webshell-adds-gsocket-c2-backdoor.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup