Researchers observed a new PHP web shell dubbed Ensiko with ransomware capabilities that attack PHP installed on platforms such as Linux, Windows, macOS, and others. The malware is capable of providing remote access and accepts commands from the attacker via a PHP reverse shell. It uses RIJNDAEL_128 with CBC mode to encrypt files in the web directories and appends the bak extension. It also drops an index.php file and sets it as the default page using a.htaccess file, the malware also loads additional tools onto an infected system.”]
Source: https://gbhackers.com/ensiko-web-shell-with-ransomware/