Cutting Edge

Campaign overview

MITRE ATT&CK historical record. Dates reflect source observations. Current activity and target-region classification are not asserted; Global denotes unclassified catalogue coverage. Cutting Edge was a campaign conducted by suspected China-nexus espionage actors, variously identified as UNC5221/UTA0178 and UNC5325, that began as early as December 2023 with the exploitation of zero-day vulnerabilities in Ivanti Connect Secure (previously Pulse Secure) VPN appliances. Cutting Edge targeted the U.S. defense industrial base and multiple sectors globally including telecommunications, financial, aerospace, and technology. Cutting Edge featured the use of defense evasion and living-off-the-land (LoTL) techniques along with the deployment of web shells and other custom malware.(Citation: Mandiant Cutting Edge January 2024)(Citation: Volexity Ivanti Zero-Day Exploitation January 2024)(Citation: Volexity Ivanti Global Exploitation January 2024)(Citation: Mandiant Cutting Edge Part 2 January 2024)(Citation: Mandiant Cutting Edge Part 3 February 2024)

This is a historical record and does not establish current campaign activity.

Threat actor

Not established

Attribution confidence

Not established

First documented activity

2023-12-01

End date

Not established

Estimated victims

Not established

Reported impact

Not established

Unknown attribution, confidence and impact remain unspecified. Regional labels can include unspecified targets; assess the source evidence before acting.

Documented timeline

1. 2023-12-01

   Source-reported first observation; not a claim of current activity or confirmed campaign start/end.

   Source: MITRE ATT&CK

2. 2024-02-01

   Source-reported last observation; not a claim of current activity or confirmed campaign start/end.

   Source: MITRE ATT&CK

MITRE ATT&CK techniques

• T1595.002 · Vulnerability Scanning

  Reconnaissance — During Cutting Edge, threat actors used the publicly available Interactsh tool to identify Ivanti Connect Secure VPNs vulnerable to CVE-2024-21893.(Citation: Mandiant Cutting Edge Part 3 February 2024)

• T1205 · Traffic Signaling

  Stealth, Persistence, Command And Control — During Cutting Edge, threat actors sent a magic 48-byte sequence to enable the PITSOCK backdoor to communicate via the `/tmp/clientsDownload.sock` socket.(Citation: Mandiant Cutting Edge Part 3 February 2024)

• T1685 · Disable or Modify Tools

  Defense Impairment — During Cutting Edge, threat actors disabled logging and modified the `compcheckresult.cgi` component to edit the Ivanti Connect Secure built-in Integrity Checker exclusion list to evade detection.(Citation: Mandiant Cutting Edge Part 2 January 2024)(Citation: Volexity Ivanti Zero-Day Exploitation January 2024)

• T1070 · Indicator Removal

  Stealth — During Cutting Edge, threat actors cleared logs to remove traces of their activity and restored compromised systems to a clean state to bypass manufacturer mitigations for CVE-2023-46805 and CVE-2024-21887.(Citation: Mandiant Cutting Edge Part 2 January 2024)(Citation: Volexity Ivanti Zero-Day Exploitation January 2024)

• T1003.001 · LSASS Memory

  Credential Access — During Cutting Edge, threat actors used Task Manager to dump LSASS memory from Windows devices to disk.(Citation: Volexity Ivanti Zero-Day Exploitation January 2024)

• T1055 · Process Injection

  Stealth, Privilege Escalation — During Cutting Edge, threat actors used malicious SparkGateway plugins to inject shared objects into web process memory on compromised Ivanti Secure Connect VPNs to enable deployment of backdoors.(Citation: Mandiant Cutting Edge Part 3 February 2024)

• T1021.004 · SSH

  Lateral Movement — During Cutting Edge, threat actors used SSH for lateral movement.(Citation: Volexity Ivanti Zero-Day Exploitation January 2024)

• T1070.004 · File Deletion

  Stealth — During Cutting Edge, threat actors deleted `/tmp/test1.txt` on compromised Ivanti Connect Secure VPNs which was used to hold stolen configuration and cache files.(Citation: Mandiant Cutting Edge Part 2 January 2024)(Citation: Mandiant Cutting Edge Part 3 February 2024)

• T1059 · Command and Scripting Interpreter

  Execution — During Cutting Edge, threat actors used Perl scripts to enable the deployment of the THINSPOOL shell script dropper and for enumerating host data.(Citation: Mandiant Cutting Edge Part 2 January 2024)(Citation: Mandiant Cutting Edge January 2024)

• T1070.006 · Timestomp

  Stealth — During Cutting Edge, threat actors changed timestamps of multiple files on compromised Ivanti Secure Connect VPNs to conceal malicious activity.(Citation: Mandiant Cutting Edge Part 2 January 2024)(Citation: Mandiant Cutting Edge Part 3 February 2024)

• T1071.004 · DNS

  Command And Control — During Cutting Edge, threat actors used DNS to tunnel IPv4 C2 traffic.(Citation: Mandiant Cutting Edge Part 2 January 2024)

• T1554 · Compromise Host Software Binary

  Persistence — During Cutting Edge, threat actors trojanized legitimate files in Ivanti Connect Secure appliances with malicious code.(Citation: Mandiant Cutting Edge January 2024)(Citation: Volexity Ivanti Zero-Day Exploitation January 2024)(Citation: Mandiant Cutting Edge Part 2 January 2024)

• T1021.001 · Remote Desktop Protocol

  Lateral Movement — During Cutting Edge, threat actors used RDP with compromised credentials for lateral movement.(Citation: Volexity Ivanti Zero-Day Exploitation January 2024)

• T1095 · Non-Application Layer Protocol

  Command And Control — During Cutting Edge, threat actors used the Unix socket and a reverse TCP shell for C2 communications.(Citation: Mandiant Cutting Edge Part 3 February 2024)

• T1594 · Search Victim-Owned Websites

  Reconnaissance — During Cutting Edge, threat actors peformed reconnaissance of victims' internal websites via proxied connections.(Citation: Volexity Ivanti Zero-Day Exploitation January 2024)

• T1505.003 · Web Shell

  Persistence — During Cutting Edge, threat actors used multiple web shells to maintain presence on compromised Connect Secure appliances such as WIREFIRE, GLASSTOKEN, BUSHWALK, LIGHTWIRE, and FRAMESTING.(Citation: Mandiant Cutting Edge January 2024)(Citation: Volexity Ivanti Zero-Day Exploitation January 2024)

• T1105 · Ingress Tool Transfer

  Command And Control — During Cutting Edge, threat actors leveraged exploits to download remote files to Ivanti Connect Secure VPNs.(Citation: Volexity Ivanti Zero-Day Exploitation January 2024)

• T1003.003 · NTDS

  Credential Access — During Cutting Edge, threat actors accessed and mounted virtual hard disk backups to extract ntds.dit.(Citation: Volexity Ivanti Zero-Day Exploitation January 2024)

• T1572 · Protocol Tunneling

  Command And Control — During Cutting Edge, threat actors used Iodine to tunnel IPv4 traffic over DNS.(Citation: Mandiant Cutting Edge Part 2 January 2024)

• T1190 · Exploit Public-Facing Application

  Initial Access — During Cutting Edge, threat actors exploited CVE-2023-46805 and CVE-2024-21887 in Ivanti Connect Secure VPN appliances to enable authentication bypass and command injection. A server-side request forgery (SSRF) vulnerability, CVE-2024-21893, was identified later and used to bypass mitigations for the initial two vulnerabilities by chaining with CVE-2024-21887.(Citation: Mandiant Cutting Edge January 2024)(Citation: Volexity Ivanti Zero-Day Exploitation January 2024)(Citation: Volexity Ivanti Global Exploitation January 2024)(Citation: Mandiant Cutting Edge Part 2 January 2024)(Citation: Mandiant Cutting Edge Part 3 February 2024)

• T1560.001 · Archive via Utility

  Collection — During Cutting Edge, threat actors saved collected data to a tar archive.(Citation: Mandiant Cutting Edge Part 2 January 2024)

• T1059.006 · Python

  Execution — During Cutting Edge, threat actors used a Python reverse shell and the PySoxy SOCKS5 proxy tool.(Citation: Volexity Ivanti Zero-Day Exploitation January 2024)(Citation: Mandiant Cutting Edge Part 3 February 2024)

• T1584.008 · Network Devices

  Resource Development — During Cutting Edge, threat actors used compromised and out-of-support Cyberoam VPN appliances for C2.(Citation: Mandiant Cutting Edge January 2024)(Citation: Volexity Ivanti Global Exploitation January 2024)

• T1005 · Data from Local System

  Collection — During Cutting Edge, threat actors stole the running configuration and cache data from targeted Ivanti Connect Secure VPNs.(Citation: Volexity Ivanti Zero-Day Exploitation January 2024)(Citation: Mandiant Cutting Edge Part 2 January 2024)

• T1021.002 · SMB/Windows Admin Shares

  Lateral Movement — During Cutting Edge, threat actors moved laterally using compromised credentials to connect to internal Windows systems with SMB.(Citation: Volexity Ivanti Zero-Day Exploitation January 2024)

• T1082 · System Information Discovery

  Discovery — During Cutting Edge, threat actors used the ENUM4LINUX Perl script for discovery on Windows and Samba hosts.(Citation: Mandiant Cutting Edge Part 2 January 2024)

• T1056.003 · Web Portal Capture

  Collection, Credential Access — During Cutting Edge, threat actors modified the JavaScript loaded by the Ivanti Connect Secure login page to capture credentials entered.(Citation: Volexity Ivanti Zero-Day Exploitation January 2024)

• T1078.002 · Domain Accounts

  Stealth, Persistence, Privilege Escalation, Initial Access — During Cutting Edge, threat actors used compromised VPN accounts for lateral movement on targeted networks.(Citation: Volexity Ivanti Zero-Day Exploitation January 2024)

• T1056.001 · Keylogging

  Collection, Credential Access — During Cutting Edge, threat actors modified a JavaScript file on the Web SSL VPN component of Ivanti Connect Secure devices to keylog credentials.(Citation: Volexity Ivanti Zero-Day Exploitation January 2024)

• T1027.013 · Encrypted/Encoded File

  Stealth — During Cutting Edge, threat actors used a Base64-encoded Python script to write a patched version of the Ivanti Connect Secure `dsls` binary.(Citation: Mandiant Cutting Edge Part 2 January 2024)

• T1588.002 · Tool

  Resource Development — During Cutting Edge, threat actors leveraged tools including Interactsh to identify vulnerable targets, PySoxy to simultaneously dispatch traffic between multiple endpoints, BusyBox to enable post exploitation activities, and Kubo Injector to inject shared objects into process memory.(Citation: Mandiant Cutting Edge January 2024)(Citation: Mandiant Cutting Edge Part 3 February 2024)

Linked indicators

0 reviewed indicators. An indicator’s presence does not establish that every resource on shared infrastructure is malicious.

No reviewed indicators are supplied. None are inferred from the campaign description.

Documented infrastructure

No reviewed infrastructure is supplied.

Sources and evidence

• MITRE ATT&CK C0029

  Official MITRE ATT&CK campaign record C0029. Derived from mitre/cti commit 50be388e93819a5d20e71cbaaeccfda157abc846. Actor links and technique mappings are attributed to this source; confidence, victims, monetary impact and infrastructure are not inferred.

External sources retain their own licences and sharing conditions. Request a correction with supporting evidence.