WARPWIRE — Malware Profile

WARPWIRE is a Javascript credential stealer that targets plaintext passwords and usernames for exfiltration that was used during Cutting Edge to target Ivanti Connect Secure VPNs.

MITRE ATT&CK techniques (5)

• T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol
• T1056.003 Web Portal Capture
• T1059.007 JavaScript
• T1132.001 Standard Encoding
• T1554 Compromise Host Software Binary

Read the full analysis on IntelFusions