{
  "family": "godzilla",
  "sample_count": 25,
  "category": "webshell",
  "description": "Godzilla (cataloged across cybersecurity advisories under signatures including Backdoor:Java/Godzilla, Backdoor:ASP/Godzilla, Backdoor:PHP/Godzilla, and Trojan:Win32/Godzilla) is a landmark dynamic cross-platform webshell and post-exploitation implant framework created by Chinese security researchers and extensively adopted by APT espionage actors and cybercrime syndicates since 2020. Designed to provide covert, persistent server access, Godzilla encrypts and decrypts all network command traffic dynamically using AES and custom obfuscation algorithms based on pre-shared secret keys. The Godzilla manager client supports dynamic memory injection, JVM/CLR class loading without touching disk, interactive shell access, file management, database manipulation, internal network proxy pivoting, and bypass of modern Web Application Firewalls (WAF) and EDR memory inspection.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Backdoor:Java/Godzilla",
    "Backdoor:ASP/Godzilla",
    "Backdoor:PHP/Godzilla",
    "Godzilla Webshell",
    "Trojan:Win32/Godzilla"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is the Godzilla webshell framework?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Godzilla is an advanced cross-platform webshell framework that uses dynamic AES-encrypted payloads to manage compromised servers."
      }
    },
    {
      "@type": "Question",
      "name": "How does Godzilla evade Web Application Firewalls (WAF)?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It encrypts all HTTP request and response parameters using dynamic AES keys and custom encodings, concealing commands from WAF pattern matching."
      }
    },
    {
      "@type": "Question",
      "name": "What server platforms are supported by Godzilla?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Godzilla supports Java (JSP/Servlet), Microsoft .NET (ASPX), and PHP server application runtime environments."
      }
    },
    {
      "@type": "Question",
      "name": "What post-exploitation capabilities does Godzilla offer?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It provides file uploading/downloading, database management, memory-only Java class execution, internal network port forwarding, and interactive cmd shells."
      }
    },
    {
      "@type": "Question",
      "name": "How can defenders detect and remove Godzilla webshells?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Deploy File Integrity Monitoring (FIM) on web server document roots, inspect JVM runtime for unregistered memory servlets, and audit web server logs."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1505.003",
    "T1059.004",
    "T1055",
    "T1090",
    "T1027"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2020,
  "threat_actor": null,
  "delivery_mechanism": [
    "Web Application Vulnerability Exploitation (File Upload, RCE)",
    "Server Deserialization Vulnerabilities",
    "SQL Injection into Web Document Roots"
  ],
  "target_platforms": [
    "Windows Server (IIS / Tomcat)",
    "Linux Enterprise Servers (Nginx / Apache / Tomcat)"
  ],
  "capabilities": [
    "Dynamic AES-Encrypted Network Communications",
    "In-Memory Java Class & .NET Assembly Execution",
    "Internal Network SOCKS5 Proxy Pivoting",
    "Interactive Remote Command Shell",
    "Arbitrary File & Database System Manipulation"
  ],
  "technical_analysis": {
    "file_types": [
      "JSP / Java Servlet File",
      "ASPX .NET Script",
      "PHP Webshell Script"
    ],
    "network_signatures": [
      "HTTP POST requests to web scripts where request bodies and response streams consist of AES-encrypted Base64 ciphertext",
      "Absence of standard plaintext webshell parameter names (such as cmd or eval)"
    ],
    "evasion_techniques": [
      "Loading Java bytecode directly into JVM memory using custom ClassLoaders without creating disk artifacts",
      "Custom header transformation to defeat generic WAF signature detection"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "9ce1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9",
      "adf2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0"
    ],
    "registry_keys": [],
    "file_paths": [
      "/var/www/html/help.jsp",
      "C:\\inetpub\\wwwroot\\error.aspx",
      "/tmp/godzilla_agent.class"
    ]
  },
  "defensive_measures": [
    "Implement File Integrity Monitoring (FIM) across all web server document roots to alert on new or modified scripts",
    "Deploy Web Application Firewalls (WAF) with behavioral anomaly detection for uniform encrypted payload blobs",
    "Enforce least-privilege service accounts for web servers (IIS_IUSRS, www-data) and disable write permissions on executable directories"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Backdoor:Java/Godzilla",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor:Java/Godzilla"
    },
    {
      "name": "CISA Advisory - Top Webshell Threats and Detection Guidance",
      "url": "https://www.cisa.gov/news-events/cybersecurity-advisories"
    }
  ],
  "lineage": {
    "derived_from": [
      "Behinder Webshell Architecture"
    ],
    "variants": [
      "Godzilla Java JSP Shell",
      "Godzilla ASPX Shell",
      "Godzilla PHP Shell"
    ]
  },
  "motivation": "Persistent Server Compromise, Post-Exploitation & Network Pivoting",
  "sample_hashes": []
}