Hackers Exploiting JSPSpy To Manage Malicious Webshell Networks

Cybersecurity researchers have recently identified a cluster of JSPSpy web shell servers featuring an unexpected addition, Filebroser, a rebranded version of the open-source File Browser file management tool.

This discovery sheds light on how attackers continue to leverage web shells for persistent access and post-compromise operations while blending into legitimate infrastructure.

JSPSpy With Webshell Infrastructure

JSPSpy, developed in Java and first observed in 2013, has been utilized by various threat actors, including the Lazarus Group, which reportedly targeted a research organization.

The web shell provides a graphical interface for remote access and file management, making it accessible even to inexperienced operators.

Recent analysis revealed four servers hosting JSPSpy across multiple providers in China and the United States.

These include CHINANET Jilin Province Network, Huawei Public Cloud Service Technologies, China Mobile Communications Corporation, and Multacom Corporation.

Most servers operate on port 80 to blend with legitimate HTTP traffic, though one instance in China uses port 8888.

Notably, one server (124.235.147[.]90) hosts a TLS certificate issued by DigiCert for dgtmeta[.]com, first observed in September 2024 and still active as of March 2025.

Further investigation uncovered a web-facing login panel labeled “filebroser” on two servers (124.235.147[.]90 and 74.48.175[.]44).

This panel operates on port 8001 and closely resembles the legitimate File Browser project, raising questions about its purpose and potential modifications.

The filebroser panel appears to be a slightly altered version of the open-source File Browser tool, with its name changed and the same favicon retained from the original project.

Internet scans for the login page titled “登录 – filebroser” (translated as “Login – filebroser”) yielded fewer than ten results, indicating limited deployment likely specific to a single operator.

Although it remains unclear whether filebroser functions identically to its open-source counterpart or has been modified for malicious purposes, its presence alongside JSPSpy suggests it may serve as an operational tool for threat actors.

Both tools share overlapping HTTP headers, such as the “Ohc-Cache-Hit” field containing random five-character strings, which can aid defenders in refining detection queries.

Detection Strategies for Defenders

Identifying JSPSpy servers can be achieved through their consistent login page title (“JspSpy Codz By-Ninty”) or HTTP response headers like “Server: JSP3/2.0.14” and “Ohc-Cache-Hit.”

For large-scale searches, regex patterns (\b[a-zA-Z]{5}\b) can be applied to detect these headers effectively.

The overlap between JSPSpy and filebroser provides additional indicators for tracking malicious activity.

Combining weak signals such as page titles, HTTP headers, and response behaviors enables defenders to strengthen visibility into attacker infrastructure.

Web shells like JSPSpy remain a favored tool for cybercriminals due to their low footprint and ability to blend into legitimate environments.

Proactively monitoring these deployments is crucial for understanding attacker behavior and mitigating threats.

Indicators of Compromise (IOCs)

This development underscores the importance of layered detection strategies to counter evolving cyber threats effectively.

Are you from SOC/DFIR Teams?: Analyse Malware Incidents & get live Access with ANY.RUN -> Start Now for Free. 

Keep your files stored safely and securely with the SanDisk 2TB Extreme Portable SSD. With over 69,505 ratings and an impressive 4.6 out of 5 stars, this product has been purchased over 8K+ times in the past month. At only $129.99, this Amazon’s Choice product is a must-have for secure file storage.

Help keep private content private with the included password protection featuring 256-bit AES hardware encryption. Order now for just $129.99 on Amazon!

Help Power Techcratic’s Future – Scan To Support

If Techcratic’s content and insights have helped you, consider giving back by supporting the platform with crypto. Every contribution makes a difference, whether it’s for high-quality content, server maintenance, or future updates. Techcratic is constantly evolving, and your support helps drive that progress.

As a solo operator who wears all the hats, creating content, managing the tech, and running the site, your support allows me to stay focused on delivering valuable resources. Your support keeps everything running smoothly and enables me to continue creating the content you love. I’m deeply grateful for your support, it truly means the world to me! Thank you!