MITRE ATT&CKsoftware (malware)
S1114 ZIPLINE
- Domain
- enterprise
- Platforms
- Network Devices
- Version
- 1.1
- Created
- 2024-03-01
Description
ZIPLINE is a passive backdoor that was used during Cutting Edge on compromised Secure Connect VPNs for reverse shell and proxy functionality.
Related
Uses · MITRE ATT&CK (9)
- T1685 Disable or Modify Tools technique
- T1573.001 Symmetric Cryptography sub-technique
- T1059.004 Unix Shell sub-technique
- T1205 Traffic Signaling technique
- T1057 Process Discovery technique
- T1083 File and Directory Discovery technique
- T1090 Proxy technique
- T1095 Non-Application Layer Protocol technique
- T1105 Ingress Tool Transfer technique
Referenced by MITRE ATT&CK · uses (1)
- C0029 Cutting Edge campaign
References
- https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day Mandiant Cutting Edge January 2024