LITTLELAMB.WOOLTEA — Malware Profile

LITTLELAMB.WOOLTEA is a backdoor that was used by UNC5325 during Cutting Edge to deploy malware on targeted Ivanti Connect Secure VPNs and to establish persistence across system upgrades and patches.

MITRE ATT&CK techniques (7)

• T1082 System Information Discovery
• T1083 File and Directory Discovery
• T1090 Proxy
• T1095 Non-Application Layer Protocol
• T1543 Create or Modify System Process
• T1554 Compromise Host Software Binary
• T1573.002 Asymmetric Cryptography

Read the full analysis on IntelFusions