MITRE ATT&CKcampaign
C0029 Cutting Edge
- Domain
- enterprise
- Version
- 1.0
- Created
- 2024-03-01
Description
Cutting Edge was a campaign conducted by suspected China-nexus espionage actors, variously identified as UNC5221/UTA0178 and UNC5325, that began as early as December 2023 with the exploitation of zero-day vulnerabilities in Ivanti Connect Secure (previously Pulse Secure) VPN appliances. Cutting Edge targeted the U.S. defense industrial base and multiple sectors globally including telecommunications, financial, aerospace, and technology. Cutting Edge featured the use of defense evasion and living-off-the-land (LoTL) techniques along with the deployment of web shells and other custom malware.
Related
Uses · MITRE ATT&CK (42)
- T1685 Disable or Modify Tools technique
- T1027.013 Encrypted/Encoded File sub-technique
- T1584.008 Network Devices sub-technique
- S1121 LITTLELAMB.WOOLTEA software (malware)
- S1123 PITSTOP software (malware)
- S1120 FRAMESTING software (malware)
- S1118 BUSHWALK software (malware)
- S1119 LIGHTWIRE software (malware)
- S1117 GLASSTOKEN software (malware)
- S1116 WARPWIRE software (malware)
- S1115 WIREFIRE software (malware)
- S1114 ZIPLINE software (malware)
- T1594 Search Victim-Owned Websites technique
- T1595.002 Vulnerability Scanning sub-technique
- T1588.002 Tool sub-technique
- S0488 CrackMapExec software (tool)
- T1071.004 DNS sub-technique
- T1572 Protocol Tunneling technique
- T1078.002 Domain Accounts sub-technique
- T1059.006 Python sub-technique
- T1560.001 Archive via Utility sub-technique
- T1003.001 LSASS Memory sub-technique
- T1003.003 NTDS sub-technique
- T1021.001 Remote Desktop Protocol sub-technique
- T1021.002 SMB/Windows Admin Shares sub-technique
- T1021.004 SSH sub-technique
- T1056.001 Keylogging sub-technique
- T1056.003 Web Portal Capture sub-technique
- T1554 Compromise Host Software Binary technique
- T1070.004 File Deletion sub-technique
References
- https://www.volexity.com/blog/2024/01/15/ivanti-connect-secure-vpn-exploitation-goes-global/ Volexity Ivanti Global Exploitation January 2024
- https://www.mandiant.com/resources/blog/investigating-ivanti-exploitation-persistence Mandiant Cutting Edge Part 3 February 2024
- https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation Mandiant Cutting Edge Part 2 January 2024
- https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day Mandiant Cutting Edge January 2024
- https://www.volexity.com/blog/2024/01/10/active-exploitation-of-two-zero-day-vulnerabilities-in-ivanti-connect-secure-vpn/ Volexity Ivanti Zero-Day Exploitation January 2024