Threat intelligence / Campaign

Cutting Edge

[Cutting Edge](https://attack.mitre.org/campaigns/C0029) was a campaign conducted by suspected China-nexus espionage actors, variously identified as UNC5221/UTA0178 and UNC5325, that began as early as December 2023 with the exploitation of zero-day vulnerabilities in Ivanti Connect Secure (previously Pulse Secure) VPN appliances. [Cutting Edge](https://attack.mitre.org/campaigns/C0029) targeted the U.S. defense industrial base and multiple sectors globally including telecommunications, financial, aerospace, and technology. [Cutting Edge](https://attack.mitre.org/campaigns/C0029) featured the use of defense evasion and living-off-the-land (LoTL) techniques along with the deployment of web shells and other custom malware.(Citation: Mandiant Cutting Edge January 2024)(Citation: Volexity Ivanti Zero-Day Exploitation January 2024)(Citation: Volexity Ivanti Global Exploitation January 2024)(Citation: Mandiant Cutting Edge Part 2 January 2024)(Citation: Mandiant Cutting Edge Part 3 February 2024)

Campaign

TypeCampaign

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Cutting Edge](https://attack.mitre.org/campaigns/C0029) was a campaign conducted by suspected China-nexus espionage actors, variously identified as UNC5221/UTA0178 and UNC5325, that began as early as December 2023 with the exploitation of zero-day vulnerabilities in Ivanti Connect Secure (previously Pulse Secure) VPN appliances. [Cutting Edge](https://attack.mitre.org/campaigns/C0029) targeted the U.S. defense industrial base and multiple sectors globally including telecommunications, financial, aerospace, and technology. [Cutting Edge](https://attack.mitre.org/campaigns/C0029) featured the use of defense evasion and living-off-the-land (LoTL) techniques along with the deployment of web shells and other custom malware.(Citation: Mandiant Cutting Edge January 2024)(Citation: Volexity Ivanti Zero-Day Exploitation January 2024)(Citation: Volexity Ivanti Global Exploitation January 2024)(Citation: Mandiant Cutting Edge Part 2 January 2024)(Citation: Mandiant Cutting Edge Part 3 February 2024)

42 recorded

Relationships

uses

to Archive via Utility

Technique

uses

Malware

uses

to Command and Scripting Interpreter

Technique

uses

to Compromise Host Software Binary

Technique

uses

to CrackMapExec

Tool

uses

to Data from Local System

Technique

uses

to Disable or Modify Tools

Technique

uses

to DNS

Technique

uses

to Domain Accounts

Technique

uses

to Encrypted/Encoded File

Technique

uses

to Exploit Public-Facing Application

Technique

uses

to File Deletion

Technique

uses

Malware

uses

Malware

uses

Tool

uses

to Indicator Removal

Technique

uses

to Ingress Tool Transfer

Technique

uses

Technique

uses

Malware

uses

to LITTLELAMB.WOOLTEA

Malware

uses

to LSASS Memory

Technique

uses

to Network Devices

Technique

uses

to Non-Application Layer Protocol

Technique

uses

Technique

uses

Malware

uses

to Process Injection

Technique

uses

to Protocol Tunneling

Technique

uses

Technique

uses

to Remote Desktop Protocol

Technique

uses

to Search Victim-Owned Websites

Technique

uses

to SMB/Windows Admin Shares

Technique

uses

to SSH

Technique

uses

to System Information Discovery

Technique

uses

Technique

uses

Technique

uses

to Traffic Signaling

Technique

uses

to Vulnerability Scanning

Technique

uses

Malware

uses

to Web Portal Capture

Technique

uses

Technique

uses

Malware

uses

Malware

6 external

References

mitre-attack

C0029

Volexity Ivanti Global Exploitation January 2024

https://www.volexity.com/blog/2024/01/15/ivanti-connect-secure-vpn-exploitation-goes-global/

Mandiant Cutting Edge Part 3 February 2024

https://www.mandiant.com/resources/blog/investigating-ivanti-exploitation-persistence

Mandiant Cutting Edge Part 2 January 2024

https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation

Mandiant Cutting Edge January 2024

https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day

Volexity Ivanti Zero-Day Exploitation January 2024

https://www.volexity.com/blog/2024/01/10/active-exploitation-of-two-zero-day-vulnerabilities-in-ivanti-connect-secure-vpn/