MITRE ATT&CKsoftware (malware)

S9014 PHASEJAM

Published 2026-04-16 Modified 2026-05-12 Official page ↗
Domain
enterprise
Platforms
Linux, Network Devices
Version
1.0
Created
2026-04-16

Description

PHASEJAM is a dropper written as a bash shell script that modifies Ivanti Connect Secure appliance components. PHASEJAM was first reported in January 2025. PHASEJAM has previously been leveraged by People's Republic of China (PRC)- affiliated actors identified as UNC5221 and SYLVANITE.

Related

Uses · MITRE ATT&CK (15)

  • T1685 Disable or Modify Tools technique
  • T1685.003 Modify or Spoof Tool UI sub-technique
  • T1678 Delay Execution technique
  • T1027.013 Encrypted/Encoded File sub-technique
  • T1027.010 Command Obfuscation sub-technique
  • T1059.008 Network Device CLI sub-technique
  • T1565 Data Manipulation technique
  • T1554 Compromise Host Software Binary technique
  • T1036.003 Rename Legitimate Utilities sub-technique
  • T1546.004 Unix Shell Configuration Modification sub-technique
  • T1505.003 Web Shell sub-technique
  • T1489 Service Stop technique
  • T1140 Deobfuscate/Decode Files or Information technique
  • T1041 Exfiltration Over C2 Channel technique
  • T1105 Ingress Tool Transfer technique

References