In its disclosure, the ACSC provided a observed during the attack campaign. In each instance, the source code for the webshell was provided, XOR'd, and base64 encoded to prevent 'accidental mishandling' of the code. We'll look briefly at two of these webshells and outline how Imperva's Backdoor Protection effectively mitigates them. Shown below is the Awen webshell source code in its encoded form.