Webshell-based HTTP tunnel traffic via suo5/Neo-reGeorg JSP endpoints with hardcoded proxy key

Duo Tech@duotech

•updated Jul 27, 2026•1•0•3

Detects HTTP traffic patterns characteristic of suo5 and Neo-reGeorg web shell tunnels. These tools facilitate bidirectional communication through JSP endpoints (e.g., /jmx/suo5.jsp, /common/themes/top_css.jsp) by utilizing hardcoded proxy identifiers in HTTP headers. This behavior is indicative of a compromised web server acting as a pivot point for command-and-control operations.