China-Nexus APT 'Weaver Ant' Caught in Yearslong Web Shell Attack

Sygnia reported on "Weaver Ant," a China-linked APT that maintained long-term access to a major Asian telecom by deploying web shells (China Chopper and an "INMemory" variant) to execute in-memory payloads, establish recursive HTTP tunneling between web shells for lateral movement, and conceal multi-layered malicious payloads; investigators observed years-long compromise, uncovered dozens of web shells and provided technical details, IOCs, and defensive/hunting recommendations.