Lazarus Group 'June 2026 Minjun' Campaign: PHP2Shell Web Shell Exploitation of Global PHP Infrastructure — OTX Pulse Analysis & Detection Pack

---
title: Lazarus PHP2Shell Web Shell Creation via PHP Process
id: 9a7f4b3a-4e6d-4c3a-8b3e-7f8e9d0c1a2b
status: experimental
description: Detects the creation of suspicious PHP files in web-accessible directories, a key indicator of PHP2Shell deployment following CVE-2026-109618 exploitation.
author: Security Arsenal
date: 2026/10/27
references:
    - https://otx.alienvault.com/pulse/...
logsource:
    product: linux
    service: auditd
    # For Windows, use product: windows, category: file_event
detection:
    selection_paths:
        file_path:
            - '/var/www/html/*'
            - '/var/www/*/html/*'
            - '/usr/share/nginx/html/*'
            - '/opt/lampp/htdocs/*'
            - '/tmp/*'
            - '/uploads/*'
    selection_extensions:
        file_name|endswith:
            - '.php'
            - '.phtml'
            - '.php3'
            - '.php4'
            - '.php5'
            - '.php7'
            - '.phar'
    selection_suspicious_names:
        file_name|contains:
            - 'config.'
            - 'readme.'
            - 'upload.'
            - 'session.'
            - 'log.'
            - 'image.'
    condition: selection_paths and selection_extensions and selection_suspicious_names
falsepositives:
    - Legitimate file uploads by administrators
    - CMS/plugin updates
level: high
tags:
    - attack.persistence
    - attack.t1505.003  # Web Shell
    - attack.t1027      # Obfuscated Files or Information
---
title: Outbound C2 Beacon to Lazarus PHP2Shell Infrastructure
id: 8b8c7d6e-5f4e-4d3c-2b1a-0e9f8d7c6b5a
status: experimental
description: Identifies network connections to known Lazarus Group PHP2Shell C2 IP addresses.
author: Security Arsenal
date: 2026/10/27
references:
    - https://otx.alienvault.com/pulse/...
logsource:
    category: network_connection
    # or firewall, proxy
detection:
    selection_dst_ip:
        dst_ip:
            - '92.118.112.100'
            - '119.63.72.54'
            - '185.235.212.105'
            - '103.77.210.80'
            - '185.203.18.54'
            - '188.80.228.122'
            - '147.78.168.57'
            - '158.173.75.178'
    selection_protocol:
        protocol: 'tcp'
        dst_port:
            - 80
            - 443
            - 8080
    condition: selection_dst_ip and selection_protocol
falsepositives:
    - Internal IP ranges misconfigured
    - Legitimate services on these IPs (unlikely for known C2)
level: critical
tags:
    - attack.command_and_control
    - attack.t1071.001  # Web Protocols
    - attack.t1573      # Encrypted Channel
---
title: PHP Process Spawning Suspicious Child Processes
id: 7c6d5e4f-3a2b-1c9d-8e7f-6a5b4c3d2e1f
status: experimental
description: Detects web server PHP processes executing system commands, a behavior consistent with PHP2Shell web shell activity.
author: Security Arsenal
date: 2026/10/27
logsource:
    category: process_creation
    product: windows
    # For Linux, use product: linux, service: execve
detection:
    selection_parent:
        ParentImage|endswith:
            - '\php.exe'
            - '\php-cgi.exe'
            - '\php-fpm'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\whoami.exe'
            - '\net.exe'
            - '\systeminfo.exe'
            - '\curl.exe'
            - '\wget.exe'
    condition: selection_parent and selection_child
falsepositives:
    - Legitimate PHP applications that execute system commands (rare, should be tuned)
    - Web management panels
level: high
tags:
    - attack.execution
    - attack.t1059.004  # Unix Shell (on Linux variant)
    - attack.t1059.001  # PowerShell
    - attack.t1059.003  # Windows Command Shell

// Hunt for PHP2Shell web shell indicators and C2 communication in the last 7 days
let c2_ips = dynamic(["92.118.112.100","119.63.72.54","185.235.212.105","103.77.210.80","185.203.18.54","188.80.228.122","147.78.168.57","158.173.75.178"]);
// Hunt 1: Network connections to known C2 IPs
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where RemoteIP in (c2_ips)
| where RemotePort in (80, 443, 8080)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemotePort, ActionType
| extend ActionType = iff(ActionType == "ConnectionSuccess", "SUCCESSFUL", ActionType)
| sort by TimeGenerated desc;
// Hunt 2: Suspicious PHP file creation in web directories
DeviceFileEvents
| where TimeGenerated > ago(7d)
| where FolderPath has_any ("/var/www/html", "/var/www", "/usr/share/nginx/html", "/tmp", "/uploads")
| where FileName endswith ".php" or FileName endswith ".phtml"
| where FileName contains "config" or FileName contains "readme" or FileName contains "upload"
| project TimeGenerated, DeviceName, FolderPath, FileName, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
| sort by TimeGenerated desc;
// Hunt 3: PHP process spawning command shells
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName =~ "php.exe" or InitiatingProcessFileName =~ "php-cgi.exe" or InitiatingProcessFileName =~ "php-fpm"
| where FileName in~ ("cmd.exe", "powershell.exe", "whoami.exe", "net.exe")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName
| sort by TimeGenerated desc;

#!/bin/bash
# Security Arsenal - Lazarus PHP2Shell IOC Hunter v1.0
# Description: Scans Linux web servers for indicators of PHP2Shell web shell deployment and C2 activity.
# Author: Security Arsenal SOC
# Date: 2026-10-27

RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m' # No Color

C2_IPS=("92.118.112.100" "119.63.72.54" "185.235.212.105" "103.77.210.80" "185.203.18.54" "188.80.228.122" "147.78.168.57" "158.173.75.178")
WEB_DIRS=("/var/www/html" "/var/www" "/usr/share/nginx/html" "/opt/lampp/htdocs" "/home/*/public_html")
SUSPICIOUS_PHP_NAMES=("config" "readme" "upload" "session" "log" "image" "tmp" "cache")

echo -e "${YELLOW}[*] Starting Lazarus PHP2Shell Hunt on $(hostname)...${NC}"
echo "=================================================="

# Check for outbound connections to C2 IPs
echo -e "\n${YELLOW}[1] Checking for active/historical connections to C2 IPs...${NC}"
for ip in "${C2_IPS[@]}"; do
    # Check current connections
    if netstat -tuln 2>/dev/null | grep -q "$ip"; then
        echo -e "${RED}[!] ACTIVE connection to C2 IP: $ip${NC}"
        netstat -tulnp | grep "$ip"
    fi
    # Check connection logs (if conntrack or similar is used)
    if grep -q "$ip" /var/log/syslog 2>/dev/null || grep -q "$ip" /var/log/messages 2>/dev/null; then
        echo -e "${RED}[!] Historical connection to C2 IP: $ip found in logs${NC}"
        grep "$ip" /var/log/syslog* /var/log/messages* 2>/dev/null | tail -5
    fi
done

# Search for suspicious PHP files in web directories
echo -e "\n${YELLOW}[2] Searching for suspicious PHP files in web directories...${NC}"
for dir in "${WEB_DIRS[@]}"; do
    if [ -d "$dir" ]; then
        echo "Scanning: $dir"
        find "$dir" -type f \( -name "*.php" -o -name "*.phtml" -o -name "*.phar" \) -mtime -7 2>/dev/null | while read file; do
            filename=$(basename "$file")
            for susp_name in "${SUSPICIOUS_PHP_NAMES[@]}"; do
                if [[ "$filename" == *"$susp_name"* ]]; then
                    # Check file size (web shells are often small)
                    filesize=$(stat -c%s "$file" 2>/dev/null)
                    if [ "$filesize" -lt 50000 ]; then
                        echo -e "${RED}[!] Suspicious PHP file found: $file (Size: $filesize bytes)${NC}"
                        echo "    First 5 lines:"
                        head -5 "$file" 2>/dev/null | sed 's/^/    /'
                        echo ""
                    fi
                    break
                fi
            done
        done
    fi
done

# Check for recently modified PHP files in temp directories
echo -e "\n${YELLOW}[3] Checking /tmp and /var/tmp for recent PHP files...${NC}"
find /tmp /var/tmp -type f -name "*.php" -mtime -2 2>/dev/null | while read file; do
    echo -e "${RED}[!] Recent PHP file in temp dir: $file${NC}"
    file "$file"
    head -3 "$file" 2>/dev/null | sed 's/^/    /'
    echo ""
done

# Check for PHP processes with suspicious command lines
echo -e "\n${YELLOW}[4] Checking for PHP processes with suspicious command lines...${NC}"
ps aux | grep -E "(php|php-fpm)" | grep -v grep | while read line; do
    if echo "$line" | grep -qE "(base64|eval|shell_exec|system|exec)"; then
        echo -e "${RED}[!] Suspicious PHP process: $line${NC}"
    fi
done

# Check web server access logs for exploitation attempts
echo -e "\n${YELLOW}[5] Checking web server access logs for exploitation patterns...${NC}"
ACCESS_LOGS=("/var/log/apache2/access.log" "/var/log/nginx/access.log" "/var/log/httpd/access_log")
for log in "${ACCESS_LOGS[@]}"; do
    if [ -f "$log" ]; then
        echo "Scanning: $log"
        # Look for patterns associated with CVE exploitation or web shell access
        grep -E "(CVE-2026-109618|CVE-2026-109619|php2shell|\.php\?.*=|base64_decode|eval\()" "$log" 2>/dev/null | tail -10 | while read logline; do
            echo -e "${YELLOW}[*] Potential exploit/web shell access: $logline${NC}"
        done
    fi
done

echo -e "\n${GREEN}[*] Hunt completed. Review any RED alerts immediately.${NC}"
echo -e "${YELLOW}[*] If suspicious files or connections are found, isolate the host and begin forensic acquisition.${NC}"

# Optional: Auto-quarantine mode (uncomment with extreme caution)
# echo -e "${YELLOW}[*] Auto-quarantine mode would move suspicious files to /quarantine/${NC}"
# mkdir -p /quarantine
# for file in $(find /var/www/html /tmp -name "*.php" -mtime -1 2>/dev/null); do
#     mv "$file" /quarantine/ 2>/dev/null && echo "Moved $file to /quarantine/"
# done