'; } else{ echo ''; } echo 'Hillstone Networks'; } elseif ($_SERVER[HTTP_HOST] == "update1.huaantech.com.cn") { echo ''; echo 'huaantech'; } elseif ($_SERVER[HTTP_HOST] == "update1.dcnetworks.com.cn") { echo ''; echo 'dcnetworks'; } elseif ($_SERVER[HTTP_HOST] == "update1.w-ibeda.com") { if (false===strpos($_SERVER[REQUEST_URI],"/en/")) echo ''; else echo ''; echo 'w-ibeda'; } elseif ($_SERVER[HTTP_HOST] == "update1.hp-telecom.com") { echo ''; echo 'hp-telecom'; } elseif ($_SERVER[HTTP_HOST] == "update1.maipu.com") { echo ''; echo 'Maipu'; } elseif ($_SERVER[HTTP_HOST] == "update1.ncurity.com") { echo ''; echo 'Ncurity'; } elseif ($_SERVER[HTTP_HOST] == "update1.socusnetwork.com") { echo ''; echo 'Socusnetwork'; } else{ echo ''; echo 'Hillstone Networks'; } ?>
 
   
 

mal_trojan:behinder（Rule ID：1090210009）

Release Date：2025/9/15

Rule Name：Trojan Backdoor Access: Behinder Attack

Severity：critical

CVE ID：

 

Descripiton：

Behinder is a new encrypted website management client, which can probe device and excute command under the authority of web server. A server suppored script file, such as php, must be uploaded to the victim server. Then remote attackers can access the victim server via Behinder in encrypted traffic, which leads to persistent information leakage. This rule supports to defend the A3: Injection of OWASP Top 10 - 2021.
Other reference：None

 

Solution：

Update vendor patches.