APT / THREAT GROUP

SharPyShell

aliases

Last seen:Mar 17, 2026

Intelligence Profile

SharPyShell is a tiny and obfuscated ASP.NET webshell that executes commands received by an encrypted channel compiling them in memory at runtime.

SharPyShell supports only C# web applications that runs on .NET Framework >= 2.0

VB is not supported atm.

Threat Analysis

SharPyShell is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://github.com/antonioCoco/SharPyShell

→https://go.recordedfuture.com/hubfs/reports/mtp-2021-1214.pdf

→https://gteltsc.vn/blog/warning-new-attack-campaign-utilized-a-new-0day-rce-vulnerability-on-microsoft-exchange-server-12715.html

→https://research.eye.security/sharepoint-under-siege/

→https://www.trendmicro.com/en_us/research/20/i/u-s--justice-department-charges-apt41-hackers-over-global-cyberattacks.html

Quick Facts

TypeAPT / Threat Group

Aliases3

Also Known As

ASPSHELLwin.sharpyshellSharPyShell

External Intelligence

Malpedia: win.sharpyshell

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search SharPyShell