MITRE ATT&CKsoftware (malware)

S1121 LITTLELAMB.WOOLTEA

Published 2024-03-13 Modified 2025-04-15 Official page ↗
Domain
enterprise
Platforms
Network Devices
Version
1.1
Created
2024-03-13

Description

LITTLELAMB.WOOLTEA is a backdoor that was used by UNC5325 during Cutting Edge to deploy malware on targeted Ivanti Connect Secure VPNs and to establish persistence across system upgrades and patches.

Related

Uses · MITRE ATT&CK (7)

  • T1573.002 Asymmetric Cryptography sub-technique
  • T1554 Compromise Host Software Binary technique
  • T1543 Create or Modify System Process technique
  • T1082 System Information Discovery technique
  • T1083 File and Directory Discovery technique
  • T1090 Proxy technique
  • T1095 Non-Application Layer Protocol technique

Referenced by MITRE ATT&CK · uses (1)

  • C0029 Cutting Edge campaign

References