Neo-reGeorg Webshell Deployment with AES Channel for Encrypted C2

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•4

Detects the creation of files on web servers matching known Neo-reGeorg web shell tunnel variants. These files are typically used as backdoors to tunnel traffic and provide persistent access to the server.