# Suo5 HTTP Tunneling Webshell Used for Tunneling and Pivoting in IIS and Jenkins Intrusions

> AhnLab ASEC documents real-world incidents where attackers deployed the open-source Suo5 HTTP tunneling tool on compromised web servers to reach internal networks for lateral movement. One case used a file upload vulnerability to drop Suo5.Aspx (renamed FilesImages.Aspx) on a Windows IIS server; another used the Jenkins Script Console to register Suo5 in memory as a Servlet and Filter.

- **Published:** 2026-10-16T01:47:36Z
- **Last reviewed:** 2026-10-16T01:47:36Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3692
- **ID:** TL-2026-3692
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 15 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Suo5 is a publicly available HTTP/HTTPS tunneling tool (author zema1 on GitHub, first commit February 2023) that exposes a SOCKS5 proxy and relays TCP traffic through a webshell on a compromised web server. It is built on HTTP/1.1 chunked encoding, supports full-duplex and half-duplex modes, and ships server-side implementations for Java (JSP/servlet), .NET (ASPX), PHP and Node.js, including memory-shell deployment. The client supports configurable HTTP methods, headers and User-Agent strings.

According to AhnLab ASEC (published 2026-10-14), two deployment methods were observed. In the first (file-based), the attacker exploited a file upload vulnerability on a Windows Server IIS web server and uploaded Suo5.Aspx renamed to FilesImages.Aspx, then used it as a relay point into the internal network. Forensic traces include repeated POST requests to FilesImages.Aspx in IIS web logs and DLL and .Compiled files generated in the Temporary ASP.NET Files directory during dynamic compilation.

In the second (memory-resident) case, an attacker who already held administrator access to a Java-based Jenkins server used the Script Console to run Groovy code that registered Suo5 in runtime memory as both a Servlet and a Filter, leaving no file on disk. Indicators include web log requests to /login.Php or /login, Java logs showing the PluginServletFilter chain, doFilter() calls in Script1.Groovy, and ClassFormatError stack traces.

The report names no threat actor and gives no CVE. The only IOC published is MD5 810726bb14e100a122cd8fc189eb087f. Independent reporting (Synacktiv, 2025-05-12) shows Suo5 used in a separate intrusion, planted on an internet-facing Exchange server after an Ivanti CSA compromise, which suggests the tool is reused by multiple unrelated operators. Synacktiv notes the .NET variant's default User-Agent acts as a shared secret and that operators can change it with the --ua flag. Network-level detection should therefore combine web-request analysis, server behavior and internal-network connection monitoring. Severity is an analyst judgment, not a figure from the source.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1505.003 Server Software Component: Web Shell
- T1059 Command and Scripting Interpreter
- T1620 Reflective Code Loading
- T1036.005 Masquerading: Match Legitimate Resource Name or Location
- T1572 Protocol Tunneling
- T1090.001 Proxy: Internal Proxy
- T1071.001 Application Layer Protocol: Web Protocols
- T1021 Remote Services

## Sources

- [An Analysis of Suo5-Based Tunneling and Pivoting Attack Techniques Through Case Studies (AhnLab ASEC)](https://asec.ahnlab.com/en/95879/)
- [Open-source toolset of an Ivanti CSA attacker (Synacktiv)](https://synacktiv.com/en/publications/open-source-toolset-of-an-ivanti-csa-attacker)
- [zema1/suo5 - A high-performance http proxy tunneling tool (GitHub)](https://github.com/zema1/suo5)
- [MITRE ATT&CK T1505.003 Server Software Component: Web Shell](https://attack.mitre.org/techniques/T1505/003/)
- [MITRE ATT&CK T1572 Protocol Tunneling](https://attack.mitre.org/techniques/T1572/)
- [MITRE ATT&CK T1090.001 Proxy: Internal Proxy](https://attack.mitre.org/techniques/T1090/001/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3692