IPA warns of perimeter-device APT intrusions
Japan's IPA warns that attackers are exploiting VPN and edge network devices as initial access for APT-style cyber espionage, often deploying China Chopper webshells.
Sourceipa.go.jp — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
The Japanese Information-technology Promotion Agency (IPA) issued an alert highlighting a rise in 'network-penetrating' attacks that abuse vulnerabilities in perimeter security devices such as VPN appliances and internet-facing servers to gain initial access to organizational networks. The advisory references a June 2023 Mandiant report on increasingly stealthy Chinese cyber espionage activity and cites related campaigns attributed to Volt Typhoon (targeting critical infrastructure), Camaro Dragon, and Storm-0558 (exploiting internet-facing application vulnerabilities). IPA notes that in Japan specifically, threat actors have exploited certain VPN devices and servers running online storage construction package software as initial vectors this year.
A recurring post-compromise technique noted is the deployment of the China Chopper (China菜刀) webshell as a backdoor on compromised network devices or web servers, allowing persistent access. IPA states that some VPN-targeting campaigns show characteristics specific to activity in the Asia region, and that IPA may directly contact affected organizations in certain cases. Organizations are urged to patch affected VPN and storage-package software, review access logs for signs of compromise, watch for suspicious files indicative of webshell deployment, and adopt Attack Surface Management (ASM) practices per recent METI guidance to better track internet-exposed assets.
This is an informational advisory rather than a report of a specific new incident or vulnerability, aggregating known campaign activity to raise awareness among Japanese organizations about ongoing risks from unpatched perimeter devices.
Mentioned in this report
Detection guidance
Web Server Process Spawning Command Shell (Possible China Chopper Webshell)
A behavioural hunt for the technique in general.
Detects IIS/Apache/Tomcat worker processes spawning cmd.exe or powershell.exe, a common pattern when a China Chopper-style webshell executes attacker-supplied commands on a compromised internet-facing server. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Web Server Process Spawning Command Shell
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith:
- \w3wp.exe
- \httpd.exe
- \tomcat.exe
- \tomcat9.exe
- \nginx.exe
- \php-cgi.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \powershell_ise.exe
filter_known_admin:
CommandLine|contains:
- C:\Program Files\
- Backup
condition: selection and not filter_known_admin
falsepositives:
- Legitimate web application health-check or admin scripts that shell out from the
web server process
- Third-party monitoring agents integrated with IIS/Apache that invoke command-line
tools
level: high
tags:
- attack.t1505.003
- attack.t1190
- attack.persistence
id: 49935450-3edd-508b-9176-a468966c9bb8
status: experimental
author: Vorant
China Chopper-style Webshell Command Execution Pattern
A behavioural hunt for the technique in general.
Detects the characteristic China Chopper command execution pattern where cmd.exe is invoked with /c to chain a directory change and a discovery/enumeration command, typically issued by a webshell relaying attacker input. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: China Chopper Style Command Execution via Web Shell
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: \cmd.exe
CommandLine|contains:
- /c cd /d
- /c whoami
- /c net user
- /c ipconfig
- /c tasklist
- /c systeminfo
parent_web:
ParentImage|endswith:
- \w3wp.exe
- \httpd.exe
- \tomcat.exe
- \tomcat9.exe
- \php-cgi.exe
condition: selection and parent_web
falsepositives:
- Custom web application admin panels that legitimately invoke system diagnostic commands
from the server process
level: high
tags:
- attack.t1505.003
- attack.t1190
- attack.discovery
id: 8e254a03-bbe7-58d9-b2bf-1d3b21cb1dd1
status: experimental
author: Vorant
Script File Dropped into Web Root by Web Server Process
A behavioural hunt for the technique in general.
Detects creation of new script files (aspx, jsp, php) directly by a web server or application server process in a web-accessible directory, consistent with webshell deployment following exploitation of a perimeter-facing application or VPN appliance. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Webshell File Dropped by Web Server Process
logsource:
category: file_event
product: windows
detection:
selection:
Image|endswith:
- \w3wp.exe
- \httpd.exe
- \tomcat.exe
- \tomcat9.exe
- \php-cgi.exe
TargetFilename|endswith:
- .aspx
- .asp
- .jsp
- .jspx
- .php
filter_deployment:
TargetFilename|contains:
- \bin\Roslyn\
- \Temporary ASP.NET Files\
condition: selection and not filter_deployment
falsepositives:
- Legitimate application deployment or auto-publish pipelines that write script files
at runtime
- CMS or low-code platforms that dynamically generate server-side script files
level: high
tags:
- attack.t1505.003
- attack.t1190
- attack.t1133
id: 14233ad3-dcc4-57b2-8560-1460b2bdc36f
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2023/alert20230801.html
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the actors and malware it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs