Tiny Shell

Named by 3 kept items in this workspace.

2 items name it under threat actors and 1 under classification.key entities.

Search every workspace for Tiny Shell. It matches the name as written, so it can find other things that share it.

The items that name it 3

Hackers exploit Cisco SD-WAN flaw to deploy custom KeyDrift malware
articleas classification.key entities2026-10-29It is written here as TinyShell.
Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN
writeupas threat actors2026-10-28It is written here as TinyShell: backdoor family whose capabilities (file read, file write, arbitrary command execution, no interactive shell) PolyFlame's backdoor resembles, with different command codes.
file read, file write, arbitrary command execution, no interactive shell
SMTP is the key: BPFDoor and AVERAT hitting the network edge
writeupas threat actors2026-10-02
Dispatches single-byte 'S'/'U'/'D' commands for interactive shell, upload, download; same switch-case and iptables NAT-redirect logic reused byte-for-byte across two samples

All threat actors in this workspace.