Created
17th August 2023
Updated
20th May 2024
A webshell and hijacking package created by "ALFA TEaM" (aliased with "Solevisible", "Sole Sad & Invisible") which was published publicly. I've mainly seen it compromising weak Wordpress installations.
The deployed package has evolved over the years and involves several files including perl.alfa. It appears that the current public version is v4.1. It features a variety of tooling including database dumping, compression tools, and config scanners.
Some organizations and researchers attribute the team to APT-33, an Iranian group targeting the Middle East and aerospace actors but the sources for this are scant.
There are also a number of companies trading with the Alfahost moniker. These companies may provide shell based access to customers. Recon scans may be trying to find misconfigured shells from these providers. I would expect this to be unlikely compared to the documentated activities above.