indicatorurl
hxxps://github[.]com/kurtcobain555/fileshell/raw/main/geckoshell[.]txt
- First seen
- 2026-07-02
- Last seen
- 2026-07-02
- Sightings
- 1
Posts referencing this indicator
- Missed incidents, persistent threats, and response gaps: Insights from compromise assessment projects
Public GitHub repository URL used by a cron job to fetch and deploy a PHP web shell onto a Linux web server, providing persistent remote code execution.