Malware: WARPWIRE

Description

[WARPWIRE](https://attack.mitre.org/software/S1116) is a Javascript credential stealer that targets plaintext passwords and usernames for exfiltration that was used during [Cutting Edge](https://attack.mitre.org/campaigns/C0029) to target Ivanti Connect Secure VPNs.(Citation: Mandiant Cutting Edge January 2024)(Citation: Mandiant Cutting Edge Part 2 January 2024)

External References

• mitre-attack
• Mandiant Cutting Edge Part 2 January 2024
• Mandiant Cutting Edge January 2024

Techniques Used by This Malware

• T1048.003 — Exfiltration Over Unencrypted Non-C2 Protocol
• T1056.003 — Web Portal Capture
• T1059.007 — JavaScript
• T1132.001 — Standard Encoding
• T1554 — Compromise Host Software Binary