Redcap Help Php Web Shell

Ibrahim Saud@tektrix

•updated Jun 19, 2026•1•0•7

Detects the creation of a web shell named 'help.php' within REDCap application directories, a known persistence mechanism used by UNC6508.