BlueShell
- Malware type
- backdoor
- Last IoC activity
- 2026-06-19 14:15:55
- Profile updated
- 2026-07-07 13:08:11
Context
According to AhnLab, BlueShell is a backdoor malware developed in Go language, published on Github, and it supports Windows, Linux, and Mac operating systems. Currently, the original Github repository is presumed to have been deleted, but the BlueShell source code can still be obtained from other repositories. It features an explanatory ReadMe file in Chinese, indicating the possibility that the creator is a Chinese user.
Detection coverage
- 1 YARA rules
Detection rules
- SEKOIA_Backdoor_Blueshell (yara-rule)
Reports & references
- asec.ahnlab.com — 56941 (report)
- asec.ahnlab.com — 47455 (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Blueshell (report)
- asec.ahnlab.com — 56715 (report)
- hunt.io — Blueshell Four Years On Still A Formidable Threat (report)