Malware: ZIPLINE

Description

[ZIPLINE](https://attack.mitre.org/software/S1114) is a passive backdoor that was used during [Cutting Edge](https://attack.mitre.org/campaigns/C0029) on compromised Secure Connect VPNs for reverse shell and proxy functionality.(Citation: Mandiant Cutting Edge January 2024)

External References

• mitre-attack
• Mandiant Cutting Edge January 2024

Techniques Used by This Malware

• T1057 — Process Discovery
• T1059.004 — Unix Shell
• T1083 — File and Directory Discovery
• T1090 — Proxy
• T1095 — Non-Application Layer Protocol
• T1105 — Ingress Tool Transfer
• T1205 — Traffic Signaling
• T1562.001 — Disable or Modify Tools
• T1573.001 — Symmetric Cryptography