Chopper
Chopper, commonly referred to as China Chopper, is a web shell used for post-compromise access on web servers, particularly IIS and Microsoft Exchange servers. The provided content associates it with rapid deployment after initial exploitation to facilitate hands-on-keyboard activity. Reported use cases include installation following exploitation of Microsoft Exchange vulnerabilities in 2021 and in targeted Exchange attacks in August 2022 chaining CVE-2022-41040 and CVE-2022-41082, where attackers used the Chopper web shell for access, Active Directory reconnaissance, and data exfiltration. Trend Micro reported Chopper web shells being dropped via Exchange flaws in January 2021. Cisco Talos also described Chinese-speaking threat activity tracked as UAT-6382 exploiting CVE-2025-0994 in Trimble Cityworks and then deploying IIS web shells including AntSword, chinatso/Chopper, and Behinder on underlying IIS servers. Additional reporting in the content describes attacks on South Korean web servers where attackers exploited file upload vulnerabilities to install ASP/ASPX web shells including Chopper, Godzilla, and ReGe-ORG for persistence. The content links Chopper to reconnaissance behavior reflected in Sigma detection coverage, including commands and activity mapped to discovery techniques such as host, user, and account enumeration. High-confidence context in the content ties Chopper to Chinese-speaking or likely state-sponsored intrusion activity, Exchange server compromises, IIS web server persistence, and follow-on reconnaissance and exfiltration.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
3 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Post-compromise activity involves the rapid deployment of web shells such as AntSword and chinatso/Chopper on the underlying IIS web servers.
MSTIC observed activity related to a single activity group in August 2022 that achieved initial access and compromised Exchange servers by chaining CVE-2022-41040 and CVE-2022-41082 in a small number of targeted attacks. These attacks installed the Chopper web shell to facilitate hands-on-keyboard access, which the attackers used to perform Active Directory reconnaissance and data exfiltration.
MSTIC observed activity related to a single activity group in August 2022 that achieved initial access and compromised Exchange servers by chaining CVE-2022-41040 and CVE-2022-41082 in a small number of targeted attacks. These attacks installed the Chopper web shell to facilitate hands-on-keyboard access, which the attackers used to perform Active Directory reconnaissance and data exfiltration.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Post-compromise activity involves the rapid deployment of web shells such as AntSword and chinatso/Chopper on the underlying IIS web servers.
Techniques & procedures
4 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 technique
Initial Access
Persistence
1 technique
Persistence
Discovery
1 technique
Discovery
Recent activity
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Chopper is a web shell used for remote command execution and control of compromised web servers, commonly used for persistence and further exploitation.
A web shell deployed on compromised IIS servers to maintain backdoor access.
A lightweight IIS/ASP web shell used for post-exploitation interactive access (“hands-on-keyboard”) on compromised servers, enabling command execution and follow-on actions like AD reconnaissance and data exfiltration.
A web shell/backdoor dropped on vulnerable Microsoft Exchange servers via exploited Exchange flaws, enabling persistent remote access on compromised systems.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.