hxxps://github[.]com/kurtcobain555/fileshell/raw/main/geckoshell[.]txt

Posts referencing this indicator

• Missed incidents, persistent threats, and response gaps: Insights from compromise assessment projects

  KKaspersky

  Public GitHub repository URL used by a cron job to fetch and deploy a PHP web shell onto a Linux web server, providing persistent remote code execution.

  2026-07-02