Threat Summary
The pulse describes Q3 2026 intrusion activity against Windows web servers, especially IIS and Apache Tomcat-on-Windows, where operators combine public exploit paths with post-exploitation tooling rather than relying on a single bespoke implant. The named tradecraft cluster is Godzilla webshell deployment, SweetPotato and PrintSpoofer local privilege escalation, Telerik UI exploitation through CVE-2019-18935, WordPress scanning against internet-facing applications, and use of proxy/RAT-style utilities after initial access. The pulse does not attribute the activity to a named APT; the operational profile is consistent with financially motivated or access-broker-adjacent criminal crews monetizing exposed web infrastructure.
The likely chain is: enumerate vulnerable web applications and plugins, exploit Telerik UI CVE-2019-18935 or weak IIS/Tomcat configuration, upload a webshell such as Godzilla into a webroot or virtual directory, execute commands under the web service account, then escalate from IIS APPPOOL or service context to SYSTEM using SweetPotato or PrintSpoofer where the host is unpatched or misconfigured. Objectives include persistent web control, lateral movement preparation, credential theft, proxying traffic through victim servers, ransomware staging, and resale of verified access. The two IPv4 indicators and MD5 set should be treated as time-decaying but high-value pivots for retro hunting rather than proof of current compromise alone.
Threat Actor / Malware Profile
Attribution is listed as unknown, and defenders should avoid overclaiming a single actor. The malware/tool profile is clearer than the actor. Godzilla is a webshell framework commonly used to maintain encrypted or obfuscated command execution over HTTP(S), frequently through JSP/ASPX/PHP endpoints and cookie or POST-based tasking. On Windows targets, ASPX variants and IIS worker process spawning are the highest-value behavioral signal. SweetPotato abuses Windows service impersonation and token manipulation paths to elevate from service accounts such as IIS APPPOOL, Network Service, or Local Service toward SYSTEM. PrintSpoofer abuses the Print Spooler named pipe and impersonation flow to coerce privileged token context; it is especially relevant where spooler service remains enabled on servers that do not print.
Distribution is opportunistic and vulnerability-led: internet scans, vulnerable Telerik UI instances, exposed WordPress components, weak upload validation, forgotten virtual directories, and permissive application pools. Payload behavior typically includes webshell write to webroot, child processes under w3wp.exe or Tomcat service processes, encoded command execution, discovery commands, credential dumping attempts, and staged privilege escalation binaries in temporary or public folders. C2 is often blended into normal web traffic because the webshell itself is the channel; outbound beaconing may be limited until proxy tooling or secondary implants are introduced. Persistence is achieved through webshell files in obscure directories, additional uploaded shells, scheduled tasks created after SYSTEM access, malicious service creation, and sometimes legitimate admin account abuse. Anti-analysis commonly includes base64 or AES-wrapped Godzilla traffic, timestomped web files, deletion of obvious droppers, use of living-off-the-land binaries, and placement of payloads in paths resembling application content.
IOC Analysis
The pulse contains one CVE, two IPv4 addresses, and five MD5 hashes from an 18-indicator set. CVE-2019-18935 maps to Telerik UI for ASP.NET AJAX insecure deserialization and remains operationally important because exploitation can lead directly to remote code execution on web servers that expose affected handlers. The IPv4 indicators 206.82.6.22 and 2.59.133.147 should be operationalized as block-and-review objects: check egress, inbound web logs, WAF events, VPN/proxy logs, and any server-initiated connection from IIS or Tomcat hosts. Because criminal infrastructure rotates, treat absence of current hits as neutral only if coverage includes retrospective DNS, netflow, proxy, TLS SNI where available, and EDR network events.
The MD5 values 0a4be0b6c650ffdcd1c22db56f1c4aec, 10f705728d228ad949b7894c1a85a2b1, 177e34d9174766a1d187a0c82de4c02f, 18fb4e070653fc9791e0e408d8cb1c8e, and 1dbfda02d74b6a7586c4430175204c28 are best used for exact-file matching in EDR, email/web gateway detonation, share scans, and backup artifact review. Do not rely on hashes alone; webshells are frequently modified per victim. Pair hash matching with parent-child process analytics, IIS worker process command lines, unexpected writes under inetpub and Tomcat webapps, and service-control or token-impersonation telemetry. SOC teams should decode and enrich these indicators in MISP, OpenCTI, ThreatConnect, Anomali, or Sentinel watchlists; validate against ASEC reference material for family context; and convert every confirmed hit into a timeline that includes pre-exploit request URI, uploaded filename, worker process PID, child process, and post-escalation account activity.
Detection Engineering
---
title: IIS Worker Process Spawning Suspicious Command or Script Shell
id: 8f7a1d62-6d2e-4f1c-a8d4-3b9c21e5a101
status: experimental
description: Detects w3wp.exe spawning cmd, powershell, rundll32, mshta, or curl consistent with Godzilla webshell command execution after IIS/Telerik exploitation.
author: Security Arsenal
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith: '\w3wp.exe'
selection_child:
Image|endswith:
- '\cmd.exe'
- '\powershell.exe'
- '\pwsh.exe'
- '\rundll32.exe'
- '\mshta.exe'
- '\curl.exe'
- '\certutil.exe'
- '\bitsadmin.exe'
filter_common_iis:
CommandLine|contains:
- 'appcmd'
- 'iisreset'
condition: selection_parent and selection_child and not filter_common_iis
falsepositives:
- Rare administrative IIS automation or application deployment tooling.
level: high
tags:
- attack.execution
- attack.t1059
- attack.t1505.003
date: 2026/10/14
---
title: SweetPotato or PrintSpoofer Privilege Escalation Artifact Execution
id: 5d1c6aa7-2a94-4a92-9a0d-3f4b61c77e02
status: experimental
description: Identifies execution names, pipe interaction, or command markers associated with SweetPotato and PrintSpoofer privilege escalation from service context to SYSTEM.
author: Security Arsenal
logsource:
category: process_creation
product: windows
detection:
selection_names:
Image|contains:
- 'sweetpotato'
- 'printspoofer'
OriginalFileName|contains:
- 'SweetPotato'
- 'PrintSpoofer'
selection_cli:
CommandLine|contains:
- 'PrintSpoofer'
- 'SweetPotato'
- '-p '
- '-c '
- '\\pipe\'
- 'spoolss'
- 'ImpersonateNamedPipeClient'
- 'SeImpersonatePrivilege'
selection_system_child:
ParentImage|endswith:
- '\services.exe'
- '\svchost.exe'
- '\w3wp.exe'
User|contains:
- 'SYSTEM'
- 'IIS APPPOOL'
- 'NETWORK SERVICE'
- 'LOCAL SERVICE'
condition: selection_names or selection_cli or (selection_system_child and selection_cli)
falsepositives:
- Authorized penetration testing, admin scripts with similar flags, or security tooling validating privilege escalation controls.
level: critical
tags:
- attack.privilege_escalation
- attack.t1134
- attack.t1068
date: 2026/10/14
---
title: Webshell-Like File Creation in IIS or Tomcat Web Content Paths
id: 2e5bc94d-91b1-46f3-9f78-cb1142aa9d03
status: experimental
description: Detects creation of scriptable web content in IIS inetpub or Tomcat webapps roots by non-build processes, matching webshell staging behavior.
author: Security Arsenal
logsource:
category: file_event
product: windows
detection:
selection_paths:
TargetFilename|contains:
- '\inetpub\wwwroot\'
- '\inetpub\'
- '\Tomcat\webapps\'
- '\Apache Software Foundation\Tomcat\'
- '\wordpress\'
- '\wp-content\uploads\'
selection_ext:
TargetFilename|endswith:
- '.aspx'
- '.asp'
- '.ashx'
- '.asmx'
- '.jsp'
- '.jspx'
- '.php'
- '.war'
filter_deploy:
Image|endswith:
- '\msdeploy.exe'
- '\dotnet.exe'
- '\java.exe'
- '\git.exe'
condition: selection_paths and selection_ext and not filter_deploy
falsepositives:
- Content deployments, CMS updates, plugin installs, and developer publishing outside controlled change windows.
level: high
tags:
- attack.persistence
- attack.t1505.003
- attack.t1105
date: 2026/10/14
let ips = dynamic(["206.82.6.22","2.59.133.147"]);
let hashes = dynamic(["0a4be0b6c650ffdcd1c22db56f1c4aec","10f705728d228ad949b7894c1a85a2b1","177e34d9174766a1d187a0c82de4c02f","18fb4e070653fc9791e0e408d8cb1c8e","1dbfda02d74b6a7586c4430175204c28"]);
union isfuzzy=true
(DeviceNetworkEvents
| where TimeGenerated >= ago(30d)
| where RemoteIP in (ips)
| extend Signal="network_ioc", Evidence=strcat(RemoteUrl, " | ", InitiatingProcessCommandLine)
| project TimeGenerated, DeviceName, RemoteIP, RemotePort, RemoteUrl, InitiatingProcessFileName, InitiatingProcessCommandLine, Signal, Evidence),
(DeviceProcessEvents
| where TimeGenerated >= ago(30d)
| where MD5 in (hashes) or SHA256 in (hashes)
| extend Signal="hash_ioc", Evidence=ProcessCommandLine
| project TimeGenerated, DeviceName, FileName, FolderPath, MD5, SHA256, ProcessCommandLine, InitiatingProcessFileName, Signal, Evidence),
(DeviceProcessEvents
| where TimeGenerated >= ago(14d)
| where InitiatingProcessFileName =~ "w3wp.exe" or ProcessVersionInfoCompanyName has "Apache"
| where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","rundll32.exe","mshta.exe","curl.exe","certutil.exe","bitsadmin.exe")
| extend Signal="webshell_child_process", Evidence=ProcessCommandLine
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine, FolderPath, Signal, Evidence),
(DeviceFileEvents
| where TimeGenerated >= ago(14d)
| where FolderPath has_any ("\\inetpub\\","\\Tomcat\\webapps\\","\\wp-content\\uploads\\","\\wordpress\\")
| where FileName endswith_any (".aspx",".asp",".ashx",".asmx",".jsp",".jspx",".php",".war")
| where not (InitiatingProcessFileName in~ ("msdeploy.exe","dotnet.exe","java.exe","git.exe"))
| extend Signal="webroot_script_write", Evidence=FolderPath
| project TimeGenerated, DeviceName, FileName, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256, Signal, Evidence)
| summarize Hits=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Devices=dcount(DeviceName) by Signal, DeviceName, Evidence
| order by LastSeen desc
$ErrorActionPreference = 'SilentlyContinue'
$Report = @()
$IocIPs = @('206.82.6.22','2.59.133.147')
$IocMD5 = @('0a4be0b6c650ffdcd1c22db56f1c4aec','10f705728d228ad949b7894c1a85a2b1','177e34d9174766a1d187a0c82de4c02f','18fb4e070653fc9791e0e408d8cb1c8e','1dbfda02d74b6a7586c4430175204c28')
$WebPaths = @("$env:SystemDrive\inetpub","$env:ProgramFiles\Apache Software Foundation\Tomcat","${env:ProgramFiles(x86)}\Apache Software Foundation\Tomcat","$env:SystemDrive\wordpress","$env:SystemDrive\xampp\htdocs")
function Add-Finding { param($Type,$Path,$Detail) $script:Report += [pscustomobject]@{Host=$env:COMPUTERNAME; Type=$Type; Path=$Path; Detail=$Detail; Time=(Get-Date).ToString('s')} }
Get-NetTCPConnection -State Established,CloseWait,TimeWait | Where-Object { $IocIPs -contains $_.RemoteAddress } | ForEach-Object {
$p = Get-Process -Id $_.OwningProcess
Add-Finding 'NetworkIOC' ($p.Path) "Remote=$($_.RemoteAddress):$($_.RemotePort) State=$($_.State) Process=$($p.ProcessName) PID=$($_.OwningProcess)"
}
foreach ($base in $WebPaths | Where-Object { $_ -and (Test-Path $_) }) {
Get-ChildItem $base -Recurse -Force -Include *.asp,*.aspx,*.ashx,*.asmx,*.jsp,*.jspx,*.php,*.war -ErrorAction SilentlyContinue | ForEach-Object {
$md5 = (Get-FileHash $_.FullName -Algorithm MD5).Hash.ToLowerInvariant()
$recent = $_.LastWriteTime -gt (Get-Date).AddDays(-45)
$oddName = $_.Name -match '^(error|config|cache|upload|temp|index|admin|shell|godzilla| Fonts)\.' -or $_.FullName -match 'wp-content\\uploads'
if ($IocMD5 -contains $md5) { Add-Finding 'HashIOC' $_.FullName "MD5=$md5 Created=$($_.CreationTime) Modified=$($_.LastWriteTime)" }
elseif ($recent -and $oddName) { Add-Finding 'SuspiciousWebFile' $_.FullName "Recent web script Created=$($_.CreationTime) Modified=$($_.LastWriteTime) MD5=$md5" }
}
}
Get-ChildItem "$env:TEMP","$env:SystemDrive\Users\Public","$env:SystemDrive\ProgramData" -Recurse -Force -Include *sweet*potato*,*print*spoofer*,*potato*.exe,*spoofer*.exe -ErrorAction SilentlyContinue | ForEach-Object { Add-Finding 'PrivEscTool' $_.FullName "Length=$($_.Length) Modified=$($_.LastWriteTime)" }
Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Services\Spooler' | ForEach-Object { if ($_.Start -ne 4) { Add-Finding 'SpoolerEnabled' 'HKLM:\SYSTEM\CurrentControlSet\Services\Spooler' "Start=$($_.Start); disable Spooler if printing is not required" } }
Get-CimInstance Win32_Service | Where-Object { $_.PathName -match 'Temp|Public|ProgramData|AppData|w3wp|powershell -enc|cmd /c' -and $_.State -eq 'Running' } | ForEach-Object { Add-Finding 'SuspiciousService' $_.Name $_.PathName }
Get-ScheduledTask | Where-Object { $_.Actions.Execute -match 'powershell|cmd|rundll32|mshta|w3wp|ProgramData|Users\\Public' } | ForEach-Object { Add-Finding 'SuspiciousTask' $_.TaskName (($_.Actions | ForEach-Object { "$($_.Execute) $($_.Arguments)" }) -join ' | ') }
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-IIS-Logging/Operational'; StartTime=(Get-Date).AddDays(-30)} | Where-Object { $_.Message -match 'Telerik|Upload|\.ashx|\.asmx|CVE-2019-18935' } | Select-Object -First 200 | ForEach-Object { Add-Finding 'IISOperationalEvent' $_.LogName $_.Message }
$Report | Sort-Object Type, Path | Format-List
if ($Report.Count -gt 0) { $Report | Export-Csv -NoTypeInformation ".\windows_webserver_godzilla_potato_hunt_$(Get-Date -Format yyyyMMdd_HHmmss).csv" }
Response Priorities
Immediate: block 206.82.6.22 and 2.59.133.147 at egress, proxy, DNS firewall, WAF, and EDR network controls; add the five MD5 indicators to EDR and gateway block lists; isolate any IIS/Tomcat host with w3wp.exe spawning shells or with recent script writes under web content paths; capture volatile data before remediation because webshell operators often return quickly if the vulnerable application remains reachable. Confirm whether Telerik UI CVE-2019-18935 exposure exists and take affected endpoints offline if patch verification cannot be completed rapidly.
24h: although the pulse is not a credential-stealer-only campaign, assume credential exposure after SYSTEM-level escalation. Reset service accounts, application pool identities, local administrator passwords, and any domain credentials used on compromised web hosts. Review authentication logs for abnormal use of IIS APPPOOL, Network Service, newly created local admins, RDP, WinRM, SMB admin shares, and service tickets. Reimage hosts showing token impersonation, SYSTEM child processes from w3wp.exe, or confirmed Godzilla webshells; do not rely on deleting the web file.
1 week: harden the architecture that enabled the chain. Patch or remove vulnerable Telerik UI components, restrict upload handlers, block executable/script extensions in upload and temp folders, remove unused virtual directories, disable Print Spooler on servers that do not print, constrain service accounts with least privilege and deny network logon where possible, segment web servers from domain controllers and sensitive data stores, enforce EDR in block mode, deploy canary files in webroots, and add change-controlled deployment gates so legitimate publishing is distinguishable from webshell staging.
Related Resources
Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.