PHP Targeted with Glutton backdoor (Campaign)

The report describes the Glutton modular PHP backdoor framework that infects PHP files and targets mainstream frameworks (e.g., ThinkPHP, Laravel, Baota), observed across China, the U.S., Cambodia, Pakistan, and South Africa. Linked with moderate confidence to the Winnti group, Glutton embeds l0ader_shell payloads, drops ELF Winnti backdoors disguised as /lib/php-fpm, performs fileless operations, poisons pre-compromised business systems sold on cybercrime forums, and steals browser data via HackBrowserData—thereby exploiting both traditional victims and other cybercriminals.