VORANT. Threat Intelligence Sign in Get the full feed

IPA warns of perimeter-device APT intrusions

medium threat infrastructuregovernment-nationaltechnology

Japan's IPA warns that attackers are exploiting VPN and edge network devices as initial access for APT-style cyber espionage, often deploying China Chopper webshells.

The Japanese Information-technology Promotion Agency (IPA) issued an alert highlighting a rise in 'network-penetrating' attacks that abuse vulnerabilities in perimeter security devices such as VPN appliances and internet-facing servers to gain initial access to organizational networks. The advisory references a June 2023 Mandiant report on increasingly stealthy Chinese cyber espionage activity and cites related campaigns attributed to Volt Typhoon (targeting critical infrastructure), Camaro Dragon, and Storm-0558 (exploiting internet-facing application vulnerabilities). IPA notes that in Japan specifically, threat actors have exploited certain VPN devices and servers running online storage construction package software as initial vectors this year.

A recurring post-compromise technique noted is the deployment of the China Chopper (China菜刀) webshell as a backdoor on compromised network devices or web servers, allowing persistent access. IPA states that some VPN-targeting campaigns show characteristics specific to activity in the Asia region, and that IPA may directly contact affected organizations in certain cases. Organizations are urged to patch affected VPN and storage-package software, review access logs for signs of compromise, watch for suspicious files indicative of webshell deployment, and adopt Attack Surface Management (ASM) practices per recent METI guidance to better track internet-exposed assets.

This is an informational advisory rather than a report of a specific new incident or vulnerability, aggregating known campaign activity to raise awareness among Japanese organizations about ongoing risks from unpatched perimeter devices.

Mentioned in this report

Threat actors Camaro DragonStorm-0558Volt Typhoon
Malware China Chopper

Detection guidance

Web Server Process Spawning Command Shell (Possible China Chopper Webshell)

ATT&CK T1505.003

Detects IIS/Apache/Tomcat worker processes spawning cmd.exe or powershell.exe, a common pattern when a China Chopper-style webshell executes attacker-supplied commands on a compromised internet-facing server. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Web Server Process Spawning Command Shell
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \w3wp.exe
    - \httpd.exe
    - \tomcat.exe
    - \tomcat9.exe
    - \nginx.exe
    - \php-cgi.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \powershell_ise.exe
  filter_known_admin:
    CommandLine|contains:
    - C:\Program Files\
    - Backup
  condition: selection and not filter_known_admin
falsepositives:
- Legitimate web application health-check or admin scripts that shell out from the
  web server process
- Third-party monitoring agents integrated with IIS/Apache that invoke command-line
  tools
level: high
tags:
- attack.t1505.003
- attack.t1190
- attack.persistence
id: 49935450-3edd-508b-9176-a468966c9bb8
status: experimental
author: Vorant

China Chopper-style Webshell Command Execution Pattern

ATT&CK T1505.003

Detects the characteristic China Chopper command execution pattern where cmd.exe is invoked with /c to chain a directory change and a discovery/enumeration command, typically issued by a webshell relaying attacker input. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: China Chopper Style Command Execution via Web Shell
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \cmd.exe
    CommandLine|contains:
    - /c cd /d
    - /c whoami
    - /c net user
    - /c ipconfig
    - /c tasklist
    - /c systeminfo
  parent_web:
    ParentImage|endswith:
    - \w3wp.exe
    - \httpd.exe
    - \tomcat.exe
    - \tomcat9.exe
    - \php-cgi.exe
  condition: selection and parent_web
falsepositives:
- Custom web application admin panels that legitimately invoke system diagnostic commands
  from the server process
level: high
tags:
- attack.t1505.003
- attack.t1190
- attack.discovery
id: 8e254a03-bbe7-58d9-b2bf-1d3b21cb1dd1
status: experimental
author: Vorant

Script File Dropped into Web Root by Web Server Process

ATT&CK T1505.003

Detects creation of new script files (aspx, jsp, php) directly by a web server or application server process in a web-accessible directory, consistent with webshell deployment following exploitation of a perimeter-facing application or VPN appliance. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Webshell File Dropped by Web Server Process
logsource:
  category: file_event
  product: windows
detection:
  selection:
    Image|endswith:
    - \w3wp.exe
    - \httpd.exe
    - \tomcat.exe
    - \tomcat9.exe
    - \php-cgi.exe
    TargetFilename|endswith:
    - .aspx
    - .asp
    - .jsp
    - .jspx
    - .php
  filter_deployment:
    TargetFilename|contains:
    - \bin\Roslyn\
    - \Temporary ASP.NET Files\
  condition: selection and not filter_deployment
falsepositives:
- Legitimate application deployment or auto-publish pipelines that write script files
  at runtime
- CMS or low-code platforms that dynamically generate server-side script files
level: high
tags:
- attack.t1505.003
- attack.t1190
- attack.t1133
id: 14233ad3-dcc4-57b2-8560-1460b2bdc36f
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2023/alert20230801.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free