Threat reportMalwareTL-2026-3692
Suo5 HTTP Tunneling Webshell Used for Tunneling and Pivoting in IIS and Jenkins Intrusions
Suo5 HTTP Tunneling Webshell Used for Tunneling and Pivoting (TL-2026-3692), also tracked as Suo5, is a high-severity malware campaign, first published 2026-10-16. It has no confirmed attribution, affects Microsoft Internet Information Services (IIS) / ASP.NET web, maps to 9 MITRE ATT&CK techniques (T1021, T1036.005, T1059), and is covered by 9 detection rules and 15 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 9MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 15Indicators of compromise
Key facts for TL-2026-3692
- Threat ID
- TL-2026-3692
- Also known as
- Suo5, Suo5.Aspx, FilesImages.Aspx
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Detection rules
- 9
- Indicators of compromise
- 15
Malware and tooling in Suo5 HTTP Tunneling Webshell Used for Tunneling and Pivoting
Malware and tooling: Suo5, suo5
How Suo5 HTTP Tunneling Webshell Used for Tunneling and Pivoting works
AhnLab ASEC documents real-world incidents where attackers deployed the open-source Suo5 HTTP tunneling tool on compromised web servers to reach internal networks for lateral movement. One case used a file upload vulnerability to drop Suo5.Aspx (renamed FilesImages.Aspx) on a Windows IIS server; another used the Jenkins Script Console to register Suo5 in memory as a Servlet and Filter.
Suo5 is a publicly available HTTP/HTTPS tunneling tool (author zema1 on GitHub, first commit February 2023) that exposes a SOCKS5 proxy and relays TCP traffic through a webshell on a compromised web server. It is built on HTTP/1.1 chunked encoding, supports full-duplex and half-duplex modes, and ships server-side implementations for Java (JSP/servlet), .NET (ASPX), PHP and Node.js, including memory-shell deployment. The client supports configurable HTTP methods, headers and User-Agent strings.
According to AhnLab ASEC (published 2026-10-14), two deployment methods were observed. In the first (file-based), the attacker exploited a file upload vulnerability on a Windows Server IIS web server and uploaded Suo5.Aspx renamed to FilesImages.Aspx, then used it as a relay point into the internal network. Forensic traces include repeated POST requests to FilesImages.Aspx in IIS web logs and DLL and .Compiled files generated in the Temporary ASP.NET Files directory during dynamic compilation.
In the second (memory-resident) case, an attacker who already held administrator access to a Java-based Jenkins server used the Script Console to run Groovy code that registered Suo5 in runtime memory as both a Servlet and a Filter, leaving no file on disk. Indicators include web log requests to /login.Php or /login, Java logs showing the PluginServletFilter chain, doFilter() calls in Script1.Groovy, and ClassFormatError stack traces.
The report names no threat actor and gives no CVE. The only IOC published is MD5 810726bb14e100a122cd8fc189eb087f. Independent reporting (Synacktiv, 2025-05-12) shows Suo5 used in a separate intrusion, planted on an internet-facing Exchange server after an Ivanti CSA compromise, which suggests the tool is reused by multiple unrelated operators. Synacktiv notes the .NET variant's default User-Agent acts as a shared secret and that operators can change it with the --ua flag. Network-level detection should therefore combine web-request analysis, server behavior and internal-network connection monitoring. Severity is an analyst judgment, not a figure from the source.
MITRE ATT&CK techniques used in TL-2026-3692
Lateral Movement
Defense Evasion
T1036.005 Masquerading: Match Legitimate Resource Name or Location; T1620 Reflective Code Loading
Execution
T1059 Command and Scripting Interpreter
Command and Control
T1071.001 Application Layer Protocol: Web Protocols; T1090.001 Proxy: Internal Proxy; T1572 Protocol Tunneling
Initial Access
T1190 Exploit Public-Facing Application
Persistence
Affected products and versions in Suo5 HTTP Tunneling Webshell Used for Tunneling and Pivoting
- Microsoft — Internet Information Services (IIS) / ASP.NET web applications with file upload flaws
Vulnerable versions: Not specified in source - Jenkins — Jenkins (Script Console / Groovy execution with administrator access)
Vulnerable versions: Not specified in source
Remediation for Suo5 HTTP Tunneling Webshell Used for Tunneling and Pivoting
Patches
- Patch the file upload vulnerability exploited on the IIS web application (application-specific; not identified in the source)
Immediate actions
- Hunt IIS logs for repeated POST requests to unexpected .aspx files such as FilesImages.Aspx
- Review Temporary ASP.NET Files for unexpected DLL and .Compiled artifacts linked to uploaded pages
- Audit Jenkins Script Console usage, Script1.groovy execution and PluginServletFilter chain entries
- Block or alert on the MD5 810726bb14e100a122cd8fc189eb087f
- Restart Jenkins and affected web servers to clear memory-resident Servlets and Filters after evidence capture
Workarounds
- Remove script-execution permissions from Jenkins accounts that do not require them
- Deny write and execute rights to web application directories for the web server account
Longer-term hardening
- Restrict web-server and Jenkins access to internal network segments
- Disable or tightly restrict Groovy script execution (Jenkins Script Console)
- Enforce upload validation and block execution of uploaded files in web directories
- Monitor web requests, server behavior and outbound/internal network connections together
- Alert on after-hours administrative access to web and CI servers
Weaknesses (CWE) in Suo5 HTTP Tunneling Webshell Used for Tunneling and Pivoting
Timeline of Suo5 HTTP Tunneling Webshell Used for Tunneling and Pivoting
- Suo5 open-source HTTP tunneling tool (zema1/suo5) first committed on GitHub in February 2023 (day approximate; month per public repository listing)
- Synacktiv documents the Suo5 .NET variant deployed as OutlookEN.aspx under the Exchange OWA auth directory, noting the default Android/Nexus 5 User-Agent acts as a shared secret, the X-Accel-Buffering: no response header, and that Suo5 is an alternative to reGeorg/Neo-reGeorg
- Synacktiv publishes an unrelated intrusion in which attackers planted the .NET Suo5 webshell on an internet-facing Exchange server after compromising an Ivanti CSA appliance
- ASEC reports an attacker with administrator access to a Jenkins server using the Script Console to register Suo5 in memory as a Servlet and Filter via Groovy (incident date not stated; date is report publication)
- ASEC reports a file upload vulnerability on a Windows Server IIS web server used to drop Suo5.Aspx renamed FilesImages.Aspx (incident date not stated; date is report publication)
- AhnLab ASEC publishes an analysis of Suo5-based tunneling and pivoting attacks across two case studies
- ASEC publishes MD5 810726bb14e100a122cd8fc189eb087f as the sole file IOC for the Suo5 sample and lists forensic traces (repeated POSTs to FilesImages.Aspx, Temporary ASP.NET Files artifacts, ClassFormatError and PluginServletFilter entries in Java logs)
Sources cited for Suo5 HTTP Tunneling Webshell Used for Tunneling and Pivoting
- An Analysis of Suo5-Based Tunneling and Pivoting Attack Techniques Through Case Studies (AhnLab ASEC)
- Open-source toolset of an Ivanti CSA attacker (Synacktiv)
- zema1/suo5 - A high-performance http proxy tunneling tool (GitHub)
- MITRE ATT&CK T1505.003 Server Software Component: Web Shell
- MITRE ATT&CK T1572 Protocol Tunneling
- MITRE ATT&CK T1090.001 Proxy: Internal Proxy
Detection coverage for TL-2026-3692
As of 2026-10-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3692 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.