Dissection of a PHP Backdoor Leveraging php-win.exe for Stealthy Windows Persistence
Dissection of a PHP Backdoor Leveraging php-win.exe for (TL-2026-2149) is a medium-severity malware campaign, first published 2026-08-26. It has no confirmed attribution, affects PHP Group PHP for Windows (php-win.exe interpreter), maps to 10 MITRE ATT&CK techniques (T1027, T1053.005, T1059), and is covered by 9 detection rules and 15 indicators of compromise.
Key facts for TL-2026-2149
- Threat ID
- TL-2026-2149
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-08-26
- Last reviewed
- 2026-08-26
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Detection rules
- 9
- Indicators of compromise
- 15
Malware and tooling in Dissection of a PHP Backdoor Leveraging php-win.exe for
Malware and tooling: Atera, Bluetrait
DFIR.ch documented a custom PHP backdoor (5.php) found during an incident-response engagement that runs invisibly via the GUI-subsystem interpreter php-win.exe and persists as a scheduled task (ClockLauncher) plus a Windows service (ClockSystemService). It fetches commands through a cutt.ly redirect header and Pastebin, decodes them with double Base64, executes them via eval(), and was used to deploy the Atera and Bluetrait.IO RMM agents without triggering the tested EDR.
How Dissection of a PHP Backdoor Leveraging php-win.exe for works
During an incident response engagement, DFIR.ch discovered a custom PHP-based backdoor (`5.php`) persisted on a Windows host through a scheduled task named `ClockLauncher` and a companion service named `ClockSystemService`, both configured to run as LocalSystem (S-1-5-18) with HighestAvailable privileges. Instead of the standard console-mode `php.exe`, the attacker used `php-win.exe` — a GUI-subsystem build of the PHP interpreter that never spawns a visible console window — invoked through a batch launcher (`run-clock.bat`) from a UUID-named folder under `C:\Windows\Temp`.
At runtime, the backdoor issues HTTP HEAD requests to a cutt.ly-shortened URL (`https://cutt.ly/praXEwzs`) at randomized 10-30 second intervals, reads the `utm_source` query parameter off the HTTP redirect `Location` header, URL-decodes it, applies a second layer of Base64 decoding, and hands the result to PHP's `eval()` for execution — abusing a benign URL-shortener redirect as a covert command channel (a dead-drop-resolver pattern) rather than standing up dedicated C2 infrastructure. DFIR.ch's lab reproduction of the fetch chain also referenced a secondary payload hosted on Pastebin.
Commands retrieved through this channel were used to attempt a silent install of the Atera RMM agent (blocked by a security control, and the only step in the entire chain to generate a — medium-severity — EDR alert) and to successfully install the Bluetrait.IO RMM agent, which checked in to `https://dfir.bluetrait.io/simple/msp_download_agent`. The Bluetrait install left no EDR alert at all, surfacing only as a routine Windows Security Event ID 7045 (service installation), and the host's application inventory recorded the installation source as `C:\php8.4` rather than the true Temp-directory origin. The author states plainly that at least one tested EDR product did not raise a single alert across the full chain, from PHP code execution through RMM-agent installation, and that the backdoor was only found by hunting through AutoRuns data across the environment. No CVE, exploit, or named threat actor is associated with this activity; the significance is the novel invisible-execution technique (GUI-subsystem PHP interpreter) and the demonstrated detection gap across a common EDR/RMM combination, which is directly actionable for detection engineering.
MITRE ATT&CK techniques used in TL-2026-2149
Defense Evasion
T1027 Obfuscated Files or Information; T1140 Deobfuscate/Decode Files or Information; T1564.003 Hide Artifacts: Hidden Window
Persistence
T1053.005 Scheduled Task/Job: Scheduled Task; T1543.003 Create or Modify System Process: Windows Service
Execution
T1059 Command and Scripting Interpreter; T1059.003 Command and Scripting Interpreter: Windows Command Shell
Command and Control
T1071.001 Application Layer Protocol: Web Protocols; T1102.001 Web Service: Dead Drop Resolver; T1219 Remote Access Tools
Affected products and versions in Dissection of a PHP Backdoor Leveraging php-win.exe for
- PHP Group — PHP for Windows (php-win.exe interpreter)
Vulnerable versions: Any Windows PHP for Windows distribution that ships php-win.exe - Microsoft — Windows (Task Scheduler / Service Control Manager)
Vulnerable versions: Windows Server and Windows desktop hosts where an attacker with local code-execution can reach Task Scheduler and the Service Control Manager
Remediation for Dissection of a PHP Backdoor Leveraging php-win.exe for
Immediate actions
- Baseline and audit Windows Task Scheduler entries via AutoRuns (or equivalent), flagging unrecognized LocalSystem-run tasks such as ClockLauncher
- Hunt for php-win.exe execution outside known, sanctioned PHP deployments — a GUI-subsystem interpreter launched from a Temp or user-writable path is inherently suspicious
- Alert on application-inventory entries pointing to unexpected PHP install paths (e.g. C:\php8.4) that do not correspond to a sanctioned, documented PHP deployment
- Restrict or monitor outbound traffic from servers/workstations to consumer URL-shortener domains (cutt.ly, etc.) and paste-hosting domains (pastebin.com) where there is no business need
Workarounds
- Remove or restrict php-win.exe on hosts where PHP is not a sanctioned, actively used component
- Require change-management approval for any new scheduled task or service registered under the LocalSystem/S-1-5-18 context
Longer-term hardening
- Build EDR/XDR detection content for hidden-window process creation, LocalSystem-context scheduled-task/service creation, and PHP interpreters spawning system()/cmd.exe
- Maintain an approved-RMM allowlist and alert on installation of any RMM agent (Atera, Bluetrait.IO, or others) that is not on it
- Adopt recurring AutoRuns-based persistence hunting across the fleet as a standing detection-engineering practice, per the author's recommendation
- Purple-team the EDR's coverage of GUI-subsystem LOLBin execution and RMM-agent installation chains — this case shows a full chain producing zero alerts on at least one tested product
Timeline of Dissection of a PHP Backdoor Leveraging php-win.exe for
- ClockLauncher scheduled task's boot trigger StartBoundary is set to 2025-04-01T05:44:00 — a timestamp embedded in the task definition that predates the task's own registration date, as recorded by DFIR.ch's AutoRuns analysis.
- Incident responders confirm the tested EDR raised zero alerts across the full chain from PHP execution through Bluetrait agent installation; the Bluetrait install is visible only via Windows Security Event ID 7045, and the host's application inventory misattributes the PHP install source to C:\php8.4.
- Backdoor-issued commands attempt a silent install of the Atera RMM agent (blocked, generating the chain's only — medium-severity — EDR alert), then successfully install the Bluetrait.IO RMM agent, which checks in to https://dfir.bluetrait.io/simple/msp_download_agent.
- 5.php executes invisibly via php-win.exe (a GUI-subsystem PHP interpreter that spawns no console window), beginning its HTTP HEAD polling loop against the cutt.ly-shortened C2 URL every 10-30 seconds.
- ClockLauncher scheduled task registered (2025-10-01T05:44:26) under S-1-5-18 (LocalSystem) with HighestAvailable run level; the ClockSystemService service was created to launch run-clock.bat, which in turn invokes php-win.exe against 5.php from a UUID-named folder under C:\Windows\Temp.
- DFIR.ch publishes "Dissection of a PHP Backdoor leveraging php-win.exe," detailing the full technique chain and recommending routine AutoRuns-based scheduled-task hunting as a detection control.
Sources cited for Dissection of a PHP Backdoor Leveraging php-win.exe for
- Dissection of a PHP Backdoor leveraging php-win.exe
- The 6 URL Shorteners You Didn't Know Were Helping Hackers
- Understanding and Threat Hunting for RMM Software Misuse
- MuddyWater Campaign Abusing Atera Agents
- PHP Webshell Malware: Analysis, Detection, Removal
- Web Service: Dead Drop Resolver (T1102.001) — MITRE ATT&CK
- Remote Access Software (T1219) — MITRE ATT&CK
Threats related to Dissection of a PHP Backdoor Leveraging php-win.exe for
Detection coverage for TL-2026-2149
As of 2026-08-26, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2149 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.