FRAMESTING — Malware Profile

FRAMESTING is a Python web shell that was used during Cutting Edge to embed into an Ivanti Connect Secure Python package for command execution.

MITRE ATT&CK techniques (7)

• T1001 Data Obfuscation
• T1001.003 Protocol or Service Impersonation
• T1059.006 Python
• T1071.001 Web Protocols
• T1140 Deobfuscate/Decode Files or Information
• T1505.003 Web Shell
• T1554 Compromise Host Software Binary

Read the full analysis on IntelFusions