HOMETHREATSDEWMODE
APT / THREAT GROUP

DEWMODE

2
aliases
Last seen:Mar 17, 2026

Intelligence Profile

FireEye discovered the DEWMODE webshell starting mid-December 2020 after exploitation of zero-day vulnerabilities in Accellion's File Transfer Appliance. It is a PHP webshell that allows threat actors to view and download files in the victim machine. It also contains cleanup function to remove itself and clean the Apache log.

Threat Analysis

DEWMODE is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://go.recordedfuture.com/hubfs/reports/mtp-2021-0312.pdf
→https://us-cert.cisa.gov/ncas/analysis-reports/ar21-055a
→https://www.accellion.com/sites/default/files/trust-center/accellion-fta-attack-mandiant-report-full.pdf
→https://www.fireeye.com/blog/threat-research/2021/02/accellion-fta-exploited-for-data-theft-and-extortion.html

Quick Facts

TypeAPT / Threat Group
Aliases2

Also Known As

php.dewmodeDEWMODE

External Intelligence

Malpedia: php.dewmode

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search
Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.
← All Threat Actors·Geopolitics Map·Search DEWMODE
DEWMODE — APT / Threat Group | Threat Intelligence | CTIWATCH.COM