S9014 PHASEJAM

malwareEnterprise

platformsLinux · Network Devices

also known asPHASEJAM

PHASEJAM is a dropper written as a bash shell script that modifies Ivanti Connect Secure appliance components. PHASEJAM was first reported in January 2025. PHASEJAM has previously been leveraged by People's Republic of China (PRC)- affiliated actors identified as UNC5221 and SYLVANITE.

techniques used (15)

ATT&CK techniques this enables or maps to.

T1027.010Command Obfuscation
T1027.013Encrypted/Encoded File
T1036.003Rename Legitimate Utilities
T1041Exfiltration Over C2 Channel
T1059.008Network Device CLI
T1105Ingress Tool Transfer
T1140Deobfuscate/Decode Files or Information
T1489Service Stop
T1505.003Web Shell
T1546.004Unix Shell Configuration Modification
T1554Compromise Host Software Binary
T1565Data Manipulation
T1678Delay Execution
T1685Disable or Modify Tools
T1685.003Modify or Spoof Tool UI

source

Where this definition is published.

view on ATT&CK

scry

Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan