WARPWIRE — Malware Profile
WARPWIRE is a Javascript credential stealer that targets plaintext passwords and usernames for exfiltration that was used during Cutting Edge to target Ivanti Connect Secure VPNs.
MITRE ATT&CK techniques (5)
- T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol
- T1056.003 Web Portal Capture
- T1059.007 JavaScript
- T1132.001 Standard Encoding
- T1554 Compromise Host Software Binary
Attributed threat actors
- UNC5221 machine-inferred link