H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Malware

LITTLELAMB.WOOLTEA

[LITTLELAMB.WOOLTEA](https://attack.mitre.org/software/S1121) is a backdoor that was used by UNC5325 during [Cutting Edge](https://attack.mitre.org/campaigns/C0029) to deploy malware on targeted Ivanti Connect Secure VPNs and to establish persistence across system upgrades and patches.(Citation: Mandiant Cutting Edge Part 3 February 2024)

Malware
TypeMalware
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[LITTLELAMB.WOOLTEA](https://attack.mitre.org/software/S1121) is a backdoor that was used by UNC5325 during [Cutting Edge](https://attack.mitre.org/campaigns/C0029) to deploy malware on targeted Ivanti Connect Secure VPNs and to establish persistence across system upgrades and patches.(Citation: Mandiant Cutting Edge Part 3 February 2024)

Labels

malware
8 recorded

Relationships

uses
from Cutting Edge
Campaign
uses
to Asymmetric Cryptography
Technique
uses
to Compromise Host Software Binary
Technique
uses
to Create or Modify System Process
Technique
uses
to File and Directory Discovery
Technique
uses
to Non-Application Layer Protocol
Technique
uses
to Proxy
Technique
uses
to System Information Discovery
Technique
2 external

References

mitre-attack
S1121
open
Mandiant Cutting Edge Part 3 February 2024
https://www.mandiant.com/resources/blog/investigating-ivanti-exploitation-persistence
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance