Sawfly

Named by 3 kept items in this workspace.

2 items name it under threat actors and 1 under classification.key entities.

Search every workspace for Sawfly. It matches the name as written, so it can find other things that share it.

The items that name it 3

Chinese APT Exploited BeyondTrust Vulnerability as Zero-Day
articleas threat actors2026-10-16It is written here as Sawfly (lightweight PHP webshell with bidirectional encrypted C&C; primary foothold).
lightweight PHP webshell with bidirectional encrypted C&C; primary foothold
lee1981 (@lee1981b) on X
threadas classification.key entities2026-10-16
ARMORY CASTLE Exploits BeyondTrust
writeupas threat actors2026-10-15It is written here as SAWFLY (obfuscated PHP webshell, mangoapi.php).
obfuscated PHP webshell, mangoapi.php

All threat actors in this workspace.