APT / THREAT GROUP

VShell

aliases

Last seen:Mar 17, 2026

Intelligence Profile

VShell is an OST framework written in Go, enabling availability of implants for multiple platforms (Windows, Linux, macOS).

Threat Analysis

VShell is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

Intelligence Reports Mentioning VShell

BeyondTrust Flaw Used for Web Shells, Backdoors, and Data Exfiltration

The Hacker News· Feb 20, 2026

VShell and SparkRAT Observed in Exploitation of BeyondTrust Critical Vulnerability (CVE-2026-1731)

Palo Alto Unit 42· Feb 19, 2026

External References

→https://blog.eclecticiq.com/china-nexus-nation-state-actors-exploit-sap-netweaver-cve-2025-31324-to-target-critical-infrastructures

→https://blog.nviso.eu/wp-content/uploads/2025/11/VShell.pdf

→https://blog.talosintelligence.com/uat-8302/

→https://github.com/veo/vshell

→https://sysdig.com/blog/unc5174-chinese-threat-actor-vshell/

Quick Facts

TypeAPT / Threat Group

Aliases2

Also Known As

VShellwin.vshell

External Intelligence

Malpedia: win.vshell

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search VShell