reGeorg — Malware Profile
reGeorg is an open-source web shell written in Python that can be used as a proxy to bypass firewall rules and tunnel data in and out of targeted networks.
MITRE ATT&CK techniques (10)
- T1021.001 Remote Desktop Protocol
- T1021.002 SMB/Windows Admin Shares
- T1021.004 SSH
- T1059.006 Python
- T1071.001 Web Protocols
- T1090 Proxy
- T1095 Non-Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1505.003 Web Shell
- T1572 Protocol Tunneling
IntelFusions coverage
- Sandworm (UAC-0133) Plans Coordinated Cyber Sabotage Against 20 Ukrainian Critical Infrastructure Facilities: BIASBOAT Linux QUEUESEED Variant, LOADGRIP ptrace Injector, and Supply Chain Compromise 2026-02-16
- Leaked attacker server reveals an advanced intrusion campaign across Mexico 2026-06-17
- China-nexus hackers exposed after leaving their attack server open 2026-07-25