Activity timeline
T1505.003 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-07 with 61 reports, and 169 of the 170 threats were reported in the twelve months to 2026-10.
How adversaries use it
T1505.003 Web Shell is catalogued by MITRE ATT&CK under the Persistence tactic in the Enterprise matrix, as a sub-technique of T1505 Server Software Component. Threadlinqs maps 170 of 2623 tracked threats (6.5%) to it; by severity that is 114 critical, 47 high, 9 medium.
Threats that use T1505.003 most often also use T1190 Exploit Public-Facing Application (156 threats), T1005 Data from Local System (103 threats), T1071.001 Web Protocols (101 threats), T1059 Command and Scripting Interpreter (87 threats), T1068 Exploitation for Privilege Escalation (84 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.
43 tracked threat actors appear in the threats that use T1505.003; the most frequent are GhostEmperor (4), Storm-2603 (4), Cl0p (3), ShinyHunters (3), UAT-9244 (3).
Mitigations
MITRE ATT&CK lists 2 mitigations for T1505.003.
Data sources
Telemetry that can reveal T1505.003, per MITRE ATT&CK.
- Application Log — Application Log Content
- File — File Creation, File Modification
- Network Traffic — Network Traffic Content, Network Traffic Flow
- Process — Process Creation
Threat actors using it
Tracked threats
The 30 most recent of 170 tracked threats that use T1505.003.
- CISA adds Citrix NetScaler SAML memory overflow DoS (CVE-2026-88779) to KEV Cataloghigh
- Desktop AI Supercomputers, Uncensored Models and Agentic Frameworks (HexStrike-AI) Enable Automated…high
- Warlock Ransomware Attackers Hit Water and Telecom Operators via SharePoint ToolShell Exploitation (Longlegs…critical
- Bitget $387.5M Cryptocurrency Theft via Third-Party Security Product Zero-Day (Suspected DPRK / TraderTraitor)critical
- GTIG: AI-Era Vulnerability Discovery and Exploitation Surge — In-the-Wild Exploitation of BeyondTrust…critical
- CVE-2019-18935 Telerik UI Deserialization Exploited to Deploy Web Shells and a WordPress Scanner on IIS…critical
- Comment2Shell: Unauthenticated Stored XSS-to-RCE Chain in WordPress wpautop() (CVE-2026-93485)high
- CISA Adds Two Citrix NetScaler Vulnerabilities (CVE-2026-88771, CVE-2026-88772) to KEV Catalogcritical
- Citrix Patches Two Actively Exploited NetScaler Zero-Days (CVE-2026-88771, CVE-2026-88772)critical
- Two Unpatched Citrix NetScaler Zero-Day RCE Vulnerabilities Under Active Exploitationcritical
- Kiteworks Urges Customers to Shut Down Systems After Federal Threat Intelligence Warning of Possible…critical
- Two Unpatched Citrix NetScaler ADC/Gateway RCE Zero-Days Under Active Exploitationcritical
- Citrix NetScaler: Two Unpatched Zero-Day RCE Flaws Allegedly Exploited in the Wild (watchTowr Forensic Alert)high
- Kiteworks Urges Customers to Take Systems Offline Amid Suspected Zero-Day Threatcritical
- CISA Adds Four Actively Exploited KEVs: Check Point Gateway/Management RCE Flaws, Arista VeloCloud…critical
- Check Point Security Gateway VPN Pre-Auth RCE (CVE-2026-85102) and Management Path Traversal Zero-Day…critical
- CISA Adds Two Actively Exploited KEVs: SharePoint Code Injection (CVE-2026-65660) and Mikrotik RouterOS Auth…critical
- Kiteworks Urges Global Customers to Shut Down Servers for 6-9 Hours Over Federally-Warned Potential Zero-Day…high
- Autonomous AI Agent Operation (Strix, Cairn, Hermes) Steals 600K+ Payment Cards and Injects Skimmers into…critical
- Eclypsium InfraTrust Report: Mass Active Exploitation of Network Management Systems (Cisco FMC/ISE…critical
- CVE-2026-87902: Critical Unauthenticated Local File Inclusion in WordPress Core (Conditional RCE)critical
- ShinyHunters Claims FBI Breach via Unpatched Oracle PeopleSoft Zero-Day, Threatens 2-3TB of PII/PHI Leakcritical
- Chinese-Speaking 'Kapibala' Actor (Red Heron-Linked) Chains WordPress wp2shell, Zyxel GS1900, and Ubiquiti…critical
- NightEagle (APT-Q-95) Deploys GhostContainer Backdoor on Exchange, Exploits BlueKeep (CVE-2019-0708) and…critical
- Click2Shell: WordPress Theme-Preview CSRF/Selector-Injection Chain to Forced Theme Installcritical
- Click2Shell WordPress Exploit Chain Lets Attackers Gain RCE With a Single Malicious Linkcritical
- ShinyHunters Hacks Clop Ransomware Gang's Tor Leak Site via Grav CMS File Upload Flaw, Threatens 72-Hour…medium
- CISA KEV Catalog Addition: Active Exploitation of Cisco ISE Authentication Bypass (CVE-2026-76460) and…critical
- CVE-2026-27540: Unauthenticated Arbitrary File Upload in WooCommerce Wholesale Lead Capture Plugin Actively…critical
- Admin Menu Editor Pro WordPress Plugin Backdoored via Supply-Chain Compromise, 1,500 Sites Affectedcritical
Detection coverage
Threadlinqs maintains 564 detection rules mapped to T1505.003 (SPL 213, KQL 166, Sigma 185). Rule content is available to Blue tier accounts and above; this page shows counts only.
Parent technique
T1505 Server Software Component — 265 tracked threats at the technique level.