WEBC2

MITRE ATT&CK: S0109 View on attack.mitre.org

Aliases: WEBC2

First seen
2006-07-01 00:00:00
Malware type
backdoor
Family
Malware family
Operating systems
windows
Profile updated
2026-07-07 12:34:55

Targeted industries: government-and-public-sector technology-and-telecommunications

Targeted regions: country_code:us country_code:cn

Context

WEBC2 is a family of backdoor malware used by APT1 as early as July 2006. WEBC2 backdoors are designed to retrieve a webpage, with commands hidden in HTML comments or special tags, from a predetermined C2 server.

Detection coverage

  • 13 YARA rules
  • 177 Sigma rules

Malware & tools used

  • DLL (attack-pattern)
  • Ingress Tool Transfer (attack-pattern)
  • Windows Command Shell (attack-pattern)

Used by threat actors

  • APT1 (threat-actor)

Detection rules

  • MALPEDIA_Win_Webc2_Div_Auto (yara-rule)
  • MALPEDIA_Win_Webc2_Head_Auto (yara-rule)
  • MALPEDIA_Win_Webc2_Table_Auto (yara-rule)
  • MALPEDIA_Win_Webc2_Ugx_Auto (yara-rule)
  • MALPEDIA_Win_Webc2_Qbp_Auto (yara-rule)
  • MALPEDIA_Win_Webc2_Yahoo_Auto (yara-rule)
  • MALPEDIA_Win_Webc2_Adspace_Auto (yara-rule)
  • MALPEDIA_Win_Webc2_Kt3_Auto (yara-rule)
  • MALPEDIA_Win_Webc2_Greencat_Auto (yara-rule)
  • MALPEDIA_Win_Webc2_Bolid_Auto (yara-rule)
  • MALPEDIA_Win_Webc2_Cson_Auto (yara-rule)
  • MALPEDIA_Win_Webc2_Rave_Auto (yara-rule)
  • MALPEDIA_Win_Webc2_Ausov_Auto (yara-rule)

Reports & references

  • Mandiant — Mandiant Apt1 Report (report)
  • MITRE ATT&CK — S0109 (report)
  • Mandiant — Mandiant Apt1 Report (report)

External references