Threat reportMalwareTL-2026-3955
Unnamed PHP backdoor leveraging php-win.exe and cutt.ly shortened-URL C2 (scheduled task 'ClockLauncher')
Unnamed PHP backdoor leveraging php-win.exe and cutt.ly (TL-2026-3955) is a medium-severity malware campaign, first published 2026-10-20. It has no confirmed attribution, affects Microsoft Windows, maps to 11 MITRE ATT&CK techniques (T1027, T1053.005, T1059), and is covered by 9 detection rules and 14 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 11MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 14Indicators of compromise
Key facts for TL-2026-3955
- Threat ID
- TL-2026-3955
- Severity
- MEDIUM
- Status
- MONITORING
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Detection rules
- 9
- Indicators of compromise
- 14
Malware and tooling in Unnamed PHP backdoor leveraging php-win.exe and cutt.ly
Malware and tooling: Atera, Bluetrait
How Unnamed PHP backdoor leveraging php-win.exe and cutt.ly works
dfir.ch dissects an unnamed PHP-based remote access tool that polls a cutt.ly shortened URL, decodes the utm_source value in the redirect Location header (URL-decode, then double Base64) and runs the result with eval(). It persists via a SYSTEM scheduled task 'ClockLauncher' that runs run-clock.bat, which launches 5.php with the windowless GUI binary php-win.exe. The authors report the EDR products they tested did not alert on the PHP execution.
The backdoor was found during incident response by Asger Deleuran Strunk and dissected by Stephan Berger (dfir.ch, published 2025-11-16). Persistence is a scheduled task named ClockLauncher (C:\Windows\System32\Tasks\ClockLauncher). The task XML shows a boot trigger, RunLevel HighestAvailable, principal S-1-5-18 (SYSTEM), a registration date of 2025-10-01 and the author string COMPANY\ADM. The task launches run-clock.bat from C:\Windows\Temp\{0B1281F3-C9BC-4B85-AD92-0803ED04208F}\php_2\. That batch file changes into the directory and starts php-win.exe against 5.php, which loops indefinitely.
php-win.exe is a legitimate PHP distribution binary. It is the same interpreter as php.exe but is flagged as a GUI application instead of a console application, so it runs with no visible window. Dropping a portable PHP runtime into a temp directory lets the operator run a scripting-language implant without any custom compiled binary.
5.php runs a loop with a randomized sleep (the analysis reports rand(10, 30) seconds). Each iteration uses curl to request the shortened URL https://cutt.ly/praXEwzs and reads the HTTP Location header of the redirect. The command URL is built from the utm_source query parameter in that header. The value is URL-decoded, then Base64-decoded twice. The content retrieved from the resulting URL is passed to eval(). Using a URL shortener as a dead-drop means the operator can change tasking by editing the shortlink destination, and the only network indicators are connections to cutt.ly and whatever host the decoded URL points to. The source publishes no hashes, IPs, attribution or malware-family name.
A service named ClockSystemService (LocalSystem) was also present and stopped during the investigation, which suggests secondary persistence.
In lab reproductions the authors used a simplified PHP stub (curl to a pastebin.com raw URL followed by eval) and then used PHP system() calls to download and silently install an RMM agent (Bluetrait) with msiexec /qn. They report that the EDR they tested raised only a single medium alert, for the attempted Atera installation, and nothing for php-win.exe execution or the Bluetrait installation. The Bluetrait service installation was visible as Windows Event ID 7045 with an image path under C:\php8.4. The pastebin and Bluetrait items are lab artifacts, not observed attacker infrastructure. Detection guidance from the source is to review AutoRuns data for suspicious scheduled tasks. Severity is an analyst judgment; no CVE is involved.
MITRE ATT&CK techniques used in TL-2026-3955
Defense Evasion
T1027 Obfuscated Files or Information; T1140 Deobfuscate/Decode Files or Information; T1218.007 System Binary Proxy Execution: Msiexec; T1564.003 Hide Artifacts: Hidden Window
Execution
T1053.005 Scheduled Task; T1059 Command and Scripting Interpreter; T1059.003 Command and Scripting Interpreter: Windows Command Shell
Persistence
T1053.005 Scheduled Task; T1543.003 Create or Modify System Process: Windows Service
Privilege Escalation
Command and Control
T1071.001 Application Layer Protocol: Web Protocols; T1102.001 Web Service: Dead Drop Resolver; T1219 Remote Access Tools
Affected products and versions in Unnamed PHP backdoor leveraging php-win.exe and cutt.ly
- Microsoft — Windows
Vulnerable versions: Windows systems where the PHP runtime can be staged and a SYSTEM scheduled task created
Remediation for Unnamed PHP backdoor leveraging php-win.exe and cutt.ly
Immediate actions
- Hunt for php-win.exe and php.exe running from C:\Windows\Temp or other non-standard paths
- Disable and remove the ClockLauncher scheduled task and the ClockSystemService service, then delete the php_2 directory and run-clock.bat/5.php
- Block or alert on cutt.ly access from servers and non-browser processes
- Review Event ID 7045 and 4698 for unexpected service and scheduled task creation
Workarounds
- Application allow-listing to block php-win.exe and php.exe outside approved directories
- Egress filtering of URL-shortener domains where not required
Longer-term hardening
- Baseline scheduled tasks and AutoRuns data across the fleet and review diffs regularly
- Alert on interpreter runtimes (PHP) running outside approved install paths
- Restrict unsanctioned RMM agent installation with application control
- Tune EDR to cover script-runtime execution that spawns curl and msiexec
Weaknesses (CWE) in Unnamed PHP backdoor leveraging php-win.exe and cutt.ly
Timeline of Unnamed PHP backdoor leveraging php-win.exe and cutt.ly
- StartBoundary date recorded in the ClockLauncher scheduled task trigger XML
- ClockLauncher scheduled task registered (SYSTEM, boot trigger, HighestAvailable, author COMPANY\ADM) to run run-clock.bat
- Researcher lab testing of php-win.exe execution, pastebin eval stub and Bluetrait/Atera RMM installation against EDR (date per analysis of the article)
- Source recommends reviewing AutoRuns data and scheduled tasks to find the ClockLauncher persistence; Event ID 7045 captured the lab RMM service install
- Authors report tested EDR raised only one medium alert (attempted Atera install) and none for php-win.exe execution or Bluetrait installation
- Article discloses the cutt.ly/praXEwzs shortlink C2 and the utm_source URL-decode plus double-Base64 decoding chain feeding eval()
- dfir.ch publishes 'Dissection of a PHP Backdoor leveraging php-win.exe' by Stephan Berger, crediting Asger Deleuran Strunk with the initial discovery
Sources cited for Unnamed PHP backdoor leveraging php-win.exe and cutt.ly
Detection coverage for TL-2026-3955
As of 2026-10-20, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3955 across Splunk SPL, Microsoft KQL and Sigma, covering 14 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.