H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Malware

LIGHTWIRE

[LIGHTWIRE](https://attack.mitre.org/software/S1119) is a web shell written in Perl that was used during [Cutting Edge](https://attack.mitre.org/campaigns/C0029) to maintain access and enable command execution by imbedding into the legitimate compcheckresult.cgi component of Ivanti Secure Connect VPNs.(Citation: Mandiant Cutting Edge Part 2 January 2024)(Citation: Mandiant Cutting Edge January 2024)

Malware
TypeMalware
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[LIGHTWIRE](https://attack.mitre.org/software/S1119) is a web shell written in Perl that was used during [Cutting Edge](https://attack.mitre.org/campaigns/C0029) to maintain access and enable command execution by imbedding into the legitimate compcheckresult.cgi component of Ivanti Secure Connect VPNs.(Citation: Mandiant Cutting Edge Part 2 January 2024)(Citation: Mandiant Cutting Edge January 2024)

Labels

malware
6 recorded

Relationships

uses
from Cutting Edge
Campaign
uses
to Compromise Host Software Binary
Technique
uses
to Deobfuscate/Decode Files or Information
Technique
uses
to Symmetric Cryptography
Technique
uses
to Web Protocols
Technique
uses
to Web Shell
Technique
3 external

References

mitre-attack
S1119
open
Mandiant Cutting Edge Part 2 January 2024
https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation
open
Mandiant Cutting Edge January 2024
https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance