S1121 LITTLELAMB.WOOLTEA

malwareEnterprise

platformsNetwork Devices

also known asLITTLELAMB.WOOLTEA

LITTLELAMB.WOOLTEA is a backdoor that was used by UNC5325 during Cutting Edge to deploy malware on targeted Ivanti Connect Secure VPNs and to establish persistence across system upgrades and patches.

techniques used (7)

ATT&CK techniques this enables or maps to.

T1082System Information Discovery
T1083File and Directory Discovery
T1090Proxy
T1095Non-Application Layer Protocol
T1543Create or Modify System Process
T1554Compromise Host Software Binary
T1573.002Asymmetric Cryptography

used by campaigns (1)

Campaigns that use this.

C0029Cutting Edge

source

Where this definition is published.

view on ATT&CK

scry

Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan