Various APT groups are successfully using Web shell attacks on a more frequent basis.
Microsoft DART- An investigation into the breach of a customer’s Web server by Microsoft’s Detection and Response Team (DART) found a Web shell attack that had succeeded in moving through most of the ATT&CK matrix before being remediated.
The Web shell was part of an attack that placed files in numerous directories on the Web server, gaining persistence and beginning to spread laterally in the infrastructure before it was discovered, DART notes. DART also says it is seeing Web shells used more frequently by APT groups, including Zinc, Krypton, and Gallium. And the threat is growing: “Every month, Microsoft Defender Advanced Threat Protection (ATP) detects an average of 77,000 web shell and related artifacts on an average of 46,000 distinct machines,” DART says.