Bomgar Exploit - Web Shell Deployment in Support Dirs (T1505.003)

Ibrahim Saud@tektrix

•updated Jun 22, 2026•0•0•4

Identifies the threat actor dropping web shell files (.aspx, .php, .jsp) directly into the BeyondTrust/Bomgar application directories to establish persistent web-based access.