HOMETHREATSASPXSpy
APT / THREAT GROUP

ASPXSpy

Internal ID: php.aspxspy
1
aliases
Last seen:Mar 17, 2026

Intelligence Profile

ASPXSpy is an open-source web shell written in C# that allows a threat actor to accomplish various post-exploitation tasks, including file access and command execution.

Threat Analysis

ASPXSpy is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://asec.ahnlab.com/en/47455/
→https://attack.mitre.org/groups/G0096
→https://go.recordedfuture.com/hubfs/reports/mtp-2021-1214.pdf
→https://securelist.com/defttorero-tactics-techniques-and-procedures/107610/
→https://www.recordedfuture.com/full-spectrum-detections-five-popular-web-shells

Quick Facts

TypeAPT / Threat Group
Aliases1

Also Known As

php.aspxspy

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search
Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.
← All Threat Actors·Geopolitics Map·Search ASPXSpy
ASPXSpy — APT / Threat Group | Threat Intelligence | CTIWATCH.COM