When persistence is established, the attacker can keep reloading payloads even after the initial shell is removed. On Windows, that may mean copying malicious JSP files into multiple web paths and executing dropped binaries. On Linux, it may mean downloading scripts, collecting SSH material, infecting nearby hosts, and launching a miner that survives basic cleanup.
Why This Matters for Security Teams
Tomcat persistence is not just a web server issue. It creates a durable foothold that lets an attacker reintroduce payloads, revive access after cleanup, and move from one execution path to another without starting over. On Windows, that often means webroot abuse plus dropped binaries or service-based follow-on activity. On Linux, it can mean script-based persistence, SSH material harvesting, and lateral spread through adjacent hosts and shared credentials.
Security teams miss the significance when they treat the initial shell as the incident, rather than the persistence mechanism as the real control failure. Mapping observed behavior to MITRE ATT&CK Enterprise Matrix helps teams separate isolated execution from durable access patterns and align detections to the full intrusion chain.
In practice, many security teams discover Tomcat persistence only after reinfection, not through intentional monitoring of the web tier and its process children.
How It Works in Practice
Attackers usually use Tomcat as an execution pivot, then add persistence where the application stack is already trusted. The exact method varies by platform, but the pattern is consistent: write files into locations Tomcat can serve or execute from, stage additional tooling, and ensure the payload can be relaunched after a reboot, a process restart, or a partial cleanup.
- On Windows, attackers may drop JSP files into exposed paths, use Tomcat to run commands, and then pivot to binaries that survive basic webshell removal.
- On Linux, they may download scripts, modify startup or user-level paths, and collect SSH keys or other access material for reuse.
- Where privilege is available, they may expand into service installation, scheduled execution, or broader host compromise.
Detection should focus on the web application process tree, unusual file writes under Tomcat directories, unexpected child processes, and outbound connections that do not match normal application behavior. When the threat resembles automated exploitation or multi-stage intrusion, the CISA cyber threat advisories are useful for understanding current tradecraft and operational indicators without overfitting to a single sample.
Hardening should include least privilege for the Tomcat service account, explicit execution restrictions in web directories, monitoring for new JSP or script artifacts, and rapid triage of any unexplained process spawned by the application server. This guidance breaks down in environments where Tomcat is used as a general-purpose automation engine, because legitimate file writes and child processes can mask attacker activity.
Common Variations and Edge Cases
Tighter application control often increases operational overhead, requiring organisations to balance service flexibility against a smaller attack surface. That tradeoff becomes sharper when legacy applications depend on writable web paths, embedded scripts, or shared administrative access.
Current guidance suggests treating persistence as environment-specific, not one-size-fits-all. In some Linux deployments, attackers rely on cron-like execution or SSH-based persistence rather than obvious webshell placement. In Windows-heavy estates, they may use Tomcat as the launcher and then shift persistence into native mechanisms that survive application removal. The attacker’s goal is durability, not necessarily elegance.
For incident responders, the practical question is whether the Tomcat compromise is isolated or part of a broader identity and host compromise. If SSH material, service credentials, or reusable tokens are exposed, the blast radius extends beyond the application server and may require credential rotation, host rebuilds, and lateral movement review. When automation is tied to the same server, distinguishing legitimate maintenance from attacker persistence is often the hardest judgment call.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | DE.CM-1 | Tomcat persistence is usually exposed through weak monitoring of files and process activity. |
| MITRE ATT&CK | T1505.003 | Tomcat web shell persistence maps directly to server software component modification. |
Watch webroot writes, child processes, and unusual outbound traffic from Tomcat hosts.
Related resources from NHI Mgmt Group
- How should security teams respond when a Node package uses autostart persistence and process masquerading on Windows endpoints?
- What happens when an attacker uses a compromised Global Administrator account to extend Azure control?
- What happens when a human uses an NHI account?
- How can teams spot proxy abuse on compromised Linux systems?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 1, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
