Mandiant Cutting Edge January 2024

WARPWIRE can send captured credentials to C2 via HTTP `GET` or `POST` requests.

WARPWIRE can capture credentials submitted during the web logon process in order to access layer seven applications such as RDP.

ZIPLINE can identify running processes and their names.

During Cutting Edge, threat actors used Perl scripts to enable the deployment of the THINSPOOL shell script dropper and for enumerating host data.

ZIPLINE can use `/bin/sh` to create a reverse shell and execute commands.

WARPWIRE is a credential harvester written in JavaScript.

WIREFIRE can respond to specific HTTP `POST` requests to `/api/v1/cav/client/visits`.

ZIPLINE can find and append specific files on Ivanti Connect Secure VPNs based upon received commands.

ZIPLINE can create a proxy server on compromised hosts.

ZIPLINE can download files to be saved on the compromised system.

WIREFIRE has the ability to download files to compromised devices.

WARPWIRE can Base64 encode captured credentials with `btoa()` prior to sending to C2.

WIREFIRE can Base64 encode process output sent to C2.

WIREFIRE can decode, decrypt, and decompress data received in C2 HTTP `POST` requests.

During Cutting Edge, threat actors exploited CVE-2023-46805 and CVE-2024-21887 in Ivanti Connect Secure VPN appliances to enable authentication bypass and command injection. A server-side request forgery (SSRF) vulnerability, CVE-2024-21893, was identified later and used to bypass mitigations for the initial two vulnerabilities by chaining with CVE-2024-21887.

ZIPLINE can identify a specific string in intercepted network traffic, `SSH-2.0-OpenSSH_0.3xx.`, to trigger its command functionality.

WIREFIRE is a web shell that can download files to and execute arbitrary commands from compromised Ivanti Connect Secure VPNs.

During Cutting Edge, threat actors used multiple web shells to maintain presence on compromised Connect Secure appliances such as WIREFIRE, GLASSTOKEN, BUSHWALK, LIGHTWIRE, and FRAMESTING.

LIGHTWIRE can imbed itself into the legitimate `compcheckresult.cgi` component of Ivanti Connect Secure VPNs to enable command execution.

WARPWIRE can embed itself into a legitimate file on compromised Ivanti Connect Secure VPNs.

During Cutting Edge, threat actors trojanized legitimate files in Ivanti Connect Secure appliances with malicious code.

WIREFIRE can modify the `visits.py` component of Ivanti Connect Secure VPNs for file download and arbitrary command execution.

WIREFIRE can AES encrypt process output sent from compromised devices to C2.

During Cutting Edge, threat actors used compromised and out-of-support Cyberoam VPN appliances for C2.

During Cutting Edge, threat actors leveraged tools including Interactsh to identify vulnerable targets, PySoxy to simultaneously dispatch traffic between multiple endpoints, BusyBox to enable post exploitation activities, and Kubo Injector to inject shared objects into process memory.

ZIPLINE can add itself to the exclusion list for the Ivanti Connect Secure Integrity Checker Tool if the `--exclude` parameter is passed by the `tar` process.