Google UNC5221 Ivanti January 2025

PHASEJAM has encoded commands with Base64.

DRYHOOK has encrypted stolen credentials strings within a file using both Base64 and RC4 with a hard-coded key.

PHASEJAM has launched a webshell using the `MIME::Base64` module that encoded and decoded Base64 commands.

PHASEJAM has renamed the file `/home/bin/remotedebug` to `remotedebug.bak`, allowing the threats actors to write a malicious `/home/bin/remotedebug` shell script.

SPAWNCHIMERA has monitored and filtered network traffic on compromised edge devices, allowing legitimate traffic to pass while redirecting attacker-controlled traffic to infrastructure under adversary control.

PHASEJAM has the ability to exfiltrate data from the victim appliance.

DRYHOOK has captured user credentials and passwords in plaintext and has encrypted them in a stored file on the network device.

DRYHOOK is a Python-based script that executes within the victim environment.

DRYHOOK has the ability to interact with Ivanti Connect Secure environments and to modify system components.

PHASEJAM has leveraged native commands associated with the compromised network appliance to execute code.

DRYHOOK has stored stolen credentials for future use in the temp folder of a victimized Ivanti Connect Secure VPN device, specifically in the file location `/tmp/cmmmap.kumMW`.

PHASEJAM has the ability to upload files onto the compromised appliance.

PHASEJAM has the ability to decode Base64 commands and data.

DRYHOOK has the ability to remount the filesystem as “read-write” to make changes and then restores it to “read-only” prior to killing processes to apply the modifications.

PHASEJAM has disabled the `cgi-server` process on Ivanti Connect Secure appliances.

DRYHOOK has terminated all instances of the `cgi-server` process before activating the modified DSAuth.pm file.

PHASEJAM has inserted Perl-based web shells into legitimate files that provided threat actors with remote access and code execution capabilities on the compromised network appliance.

PHASEJAM has used a bash script to modify components on Ivanti Connect Secure appliances and execute files via `/bin/bash`.[1] It has also used the Linux stream editor (`sed`) to execute commands.

SPAWNCHIMERA has generated RSA keys against modified files to sign the manifest file, so they appear legitimate.

PHASEJAM has modified legitimate components to enable persistence and execution, including inserting a web shell into `getComponent.cgi` and `restAuth.cgi`, modifying `DSUpgrade.pm` to block system upgrades, and overwriting `remotedebug` to execute arbitrary commands when specific parameters are provided.

DRYHOOK has intercepted and logged user credentials by modifying the Perl module in Ivanti Connect Secure VPN edge-devices located within `/home/perl/DSAuth.pm`.

DRYHOOK has patched victim appliances authentication routines to capture credentials in plaintext as users log in.

PHASEJAM has blocked legitimate upgrades of Ivanti Connect Secure systems and falsely indicates a successful upgrade while operating on an older version.

SPAWNCHIMERA has created SSH tunnels to facilitate C2 communications.

SPAWNCHIMERA can persist across system upgrades by hijacking the execution flow of dspkginstall, a binary used during the system upgrade process.

DRYHOOK has modified the Ivanti Connect Secure VPN authentication Perl module `DSAuth.pm` by reading its contents in the buffer, then finding and replacing select lines of code.

PHASEJAM has used the `sleep` command within its code to generate a fake HTML upgrade progress bar that mimics a running process.

DRYHOOK has killed all instances of the `cgi-server` process in order for the modified Perl module to be activated.

PHASEJAM has modified Ivanti Connect Secure appliances and blocks the system upgrades by altering the DSUpgrade.pm file.

PHASEJAM has prevented legitimate Ivanti Connect Secure system upgrades by intercepting the upgrade command and rendering fake HTML upgrade progress bar through a function called `processUpgradeDisplay()` which allowed the compromised device to remain under the control of the adversary.