LIGHTWIRE — Malware Profile

LIGHTWIRE is a web shell written in Perl that was used during Cutting Edge to maintain access and enable command execution by imbedding into the legitimate compcheckresult.cgi component of Ivanti Secure Connect VPNs.

MITRE ATT&CK techniques (5)

• T1071.001 Web Protocols
• T1140 Deobfuscate/Decode Files or Information
• T1505.003 Web Shell
• T1554 Compromise Host Software Binary
• T1573.001 Symmetric Cryptography

Read the full analysis on IntelFusions