Vshell Gains Traction Among Threat Actors as an Alternative to Cobalt Strike
A Go-based command-and-control (C2) framework, originally used within Chinese-speaking offensive security circles, is gaining traction among threat actors due to its flexibility and cost-effectiveness compared to expensive commercial tools.
A Go-based command-and-control (C2) framework, originally used within Chinese-speaking offensive security circles, is gaining traction among threat actors due to its flexibility and cost-effectiveness compared to expensive commercial tools.
Vshell, which first appeared in 2021, was initially a lightweight C2 platform managed through the AntSword web shell framework. It is designed to administer compromised Windows and Linux hosts , with capabilities for network pivoting and lateral movement.
By its third version, Vshell directly targeted users of Cobalt Strike, appealing to those who found commercial adversary simulation tools costly or complex. Censys analysts have discovered internet-facing Vshell deployments, revealing panels configured with numerous connected client agents.
Vshell has been used in various threat campaigns, including Operation DRAGONCLONE and the SNOWLIGHT campaign. These occurrences indicate that Vshell has evolved into a widely trusted tool within the broader threat landscape.
Vshell, which first appeared in 2021, was initially a lightweight C2 platform managed through the AntSword web shell framework.
Version 4 of Vshell introduced licensing controls, an interface redesign, and nginx impersonation. The tool's development continued privately after 2024, suggesting ongoing investment in its longevity and evasion capabilities. Censys observed over 850 active Vshell listeners, highlighting its extensive deployment.
Vshell's Multi-Protocol C2 Architecture
Vshell's flexible listener system allows operators to maintain control over compromised hosts using multiple communication channels. The "Listener Management" interface supports TCP, KCP/UDP, WebSocket, DNS, DNS-over-HTTPS (DoH), DNS-over-TLS (DoT), and Object Storage System (OSS) connections via S3 buckets. Most listeners use port TCP/8084, though DNS-based channels provide additional flexibility.
Newer Vshell panels incorporate digest authentication, complicating detection. Security teams should monitor web servers and firewalls for Vshell signs and inspect DNS-over-HTTPS and DNS-over-TLS traffic for anomalies. Detection rules for NPS-based traffic may overlap and should be utilized where applicable.
Regular threat-hunting queries and alerts for outbound communications matching Vshell patterns are recommended for enhanced defense.
Based on reporting by Cyber Security News.