Researchers Find Rebranded File Management Panel on JSPSpy Servers
Summary
Hunt researchers found a web-based file management panel called Filebroser on two of four servers hosting JSPSpy web shells. They describe the infrastructure and share HTTP indicators and page titles defenders can use to track related activity.
Key points
- Researchers identified four servers hosting JSPSpy web shells across China and the United States; most used port 80, while one used port 8888.
- Two of the four servers also hosted a web-facing login panel called Filebroser on port 8001.
- Filebroser resembles the open-source File Browser project, but researchers could not determine whether it works identically or how it is used.
- The researchers say JSPSpy’s login-page title, HTTP response headers, and contextual indicators can help defenders identify servers; they caution that page titles can be changed.
- The shared Ohc-Cache-Hit response-header field on JSPSpy and Filebroser provides an additional signal for refining searches, but does not confirm direct integration.
- A legitimate biopharmaceutical company’s subdomain briefly resolved to a JSPSpy login page; researchers noted that compromise, an abandoned subdomain, misconfiguration, or a temporary redirect could explain it.
Article Details
- Attack Vectors
- JSPSpy web shells on compromised servers provide remote access and file management; the article says web shells can support persistence, command execution, and file extraction.
- Two servers also exposed a web-facing login panel labeled “filebroser” on port 8001; its operational relationship to JSPSpy is unclear.
- Defensive Notes
- Hunt for JSPSpy login pages titled “JspSpy Codz By-Ninty” and response headers including “Server: JSP3/2.0.14” and “Ohc-Cache-Hit” with a five-character alphabetical value; page titles can be modified.
- Monitor for web shells on non-standard ports, including port 8888, and correlate HTTP headers, response behavior, and page titles.
- The article cautions that the shared TLS certificate does not establish that associated IP addresses are malicious.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 113[.]45[.]180[.]224 | JSPSpy server identified in the article’s network observables. |
| IPV4 | 124[.]235[.]147[.]90 | JSPSpy server; also hosted the filebroser panel on port 8001. |
| IPV4 | 22[.]176[.]159[.]209 | JSPSpy server identified in the article’s network observables. |
| IPV4 | 74[.]48[.]175[.]44 | JSPSpy server; also hosted the filebroser panel on port 8001. |