Security researchers at Palo Alto Networks' Unit 42 say that the attackers' goal was to plant a PHP web shell that could run arbitrary commands on the compromised communications server.

The web shell has been detected in Exchange Server-related attacks alongside DearCry ransomware deployment. China Chopper is not new and has been in the wild for at least a decade.