Mandiant Cutting Edge Part 2 January 2024

FRAMESTING can send and receive zlib compressed data within `POST` requests.

FRAMESTING uses a cookie named `DSID` to mimic the name of a cookie used by Ivanti Connect Secure appliances for maintaining VPN sessions.

During Cutting Edge, threat actors stole the running configuration and cache data from targeted Ivanti Connect Secure VPNs.

BUSHWALK can encrypt the resulting data generated from C2 commands with RC4.

During Cutting Edge, threat actors used a Base64-encoded Python script to write a patched version of the Ivanti Connect Secure `dsls` binary.

WARPWIRE can send captured credentials to C2 via HTTP `GET` or `POST` requests.

During Cutting Edge, threat actors used Perl scripts to enable the deployment of the THINSPOOL shell script dropper and for enumerating host data.

FRAMESTING is a Python web shell that can embed in the Ivanti Connect Secure CAV Python package.

During Cutting Edge, threat actors cleared logs to remove traces of their activity and restored compromised systems to a clean state to bypass manufacturer mitigations for CVE-2023-46805 and CVE-2024-21887.

During Cutting Edge, threat actors deleted `/tmp/test1.txt` on compromised Ivanti Connect Secure VPNs which was used to hold stolen configuration and cache files.

During Cutting Edge, threat actors changed timestamps of multiple files on compromised Ivanti Secure Connect VPNs to conceal malicious activity.

FRAMESTING can retrieve C2 commands from values stored in the `DSID` cookie from the current HTTP request or from decompressed zlib data within the request's `POST` data.

LIGHTWIRE can use HTTP for C2 communications.

During Cutting Edge, threat actors used DNS to tunnel IPv4 C2 traffic.

During Cutting Edge, threat actors used the ENUM4LINUX Perl script for discovery on Windows and Samba hosts.

ZIPLINE can create a proxy server on compromised hosts.

ZIPLINE can communicate with C2 using a custom binary protocol.

ZIPLINE can download files to be saved on the compromised system.

BUSHWALK can write malicious payloads sent through a web request’s command parameter.

FRAMESTING can decompress data received within `POST` requests.

BUSHWALK can Base64 decode and RC4 decrypt malicious payloads sent through a web request’s command parameter.

LIGHTWIRE can RC4 decrypt and Base64 decode C2 commands.

During Cutting Edge, threat actors exploited CVE-2023-46805 and CVE-2024-21887 in Ivanti Connect Secure VPN appliances to enable authentication bypass and command injection. A server-side request forgery (SSRF) vulnerability, CVE-2024-21893, was identified later and used to bypass mitigations for the initial two vulnerabilities by chaining with CVE-2024-21887.

LIGHTWIRE is a web shell capable of command execution and establishing persistence on compromised Ivanti Secure Connect VPNs.

BUSHWALK is a web shell that has the ability to execute arbitrary commands or write files.

FRAMESTING is a web shell capable of enabling arbitrary command execution on compromised Ivanti Connect Secure VPNs.

LIGHTWIRE can imbed itself into the legitimate `compcheckresult.cgi` component of Ivanti Connect Secure VPNs to enable command execution.

FRAMESTING can embed itself in the CAV Python package of an Ivanti Connect Secure VPN located in `/home/venv3/lib/python3.6/site-packages/cav-0.1-py3.6.egg/cav/api/resources/category.py.`

During Cutting Edge, threat actors trojanized legitimate files in Ivanti Connect Secure appliances with malicious code.

BUSHWALK can embed into the legitimate `querymanifest.cgi` file on compromised Ivanti Connect Secure VPNs.

During Cutting Edge, threat actors saved collected data to a tar archive.

During Cutting Edge, threat actors used Iodine to tunnel IPv4 traffic over DNS.

ZIPLINE can use AES-128-CBC to encrypt data for both upload and download.

LIGHTWIRE can RC4 encrypt C2 commands.

During Cutting Edge, threat actors disabled logging and modified the `compcheckresult.cgi` component to edit the Ivanti Connect Secure built-in Integrity Checker exclusion list to evade detection.