H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Malware

WIREFIRE

[WIREFIRE](https://attack.mitre.org/software/S1115) is a web shell written in Python that exists as trojanized logic to the visits.py component of Ivanti Connect Secure VPN appliances. [WIREFIRE](https://attack.mitre.org/software/S1115) was used during [Cutting Edge](https://attack.mitre.org/campaigns/C0029) for downloading files and command execution.(Citation: Mandiant Cutting Edge January 2024)

Malware
TypeMalware
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[WIREFIRE](https://attack.mitre.org/software/S1115) is a web shell written in Python that exists as trojanized logic to the visits.py component of Ivanti Connect Secure VPN appliances. [WIREFIRE](https://attack.mitre.org/software/S1115) was used during [Cutting Edge](https://attack.mitre.org/campaigns/C0029) for downloading files and command execution.(Citation: Mandiant Cutting Edge January 2024)

Labels

malware
8 recorded

Relationships

uses
from Cutting Edge
Campaign
uses
to Compromise Host Software Binary
Technique
uses
to Deobfuscate/Decode Files or Information
Technique
uses
to Ingress Tool Transfer
Technique
uses
to Standard Encoding
Technique
uses
to Symmetric Cryptography
Technique
uses
to Web Protocols
Technique
uses
to Web Shell
Technique
4 external

References

mitre-attack
S1115
open
GIFTEDVISITOR
—
Mandiant Cutting Edge January 2024
https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day
open
Volexity Ivanti Zero-Day Exploitation January 2024
https://www.volexity.com/blog/2024/01/10/active-exploitation-of-two-zero-day-vulnerabilities-in-ivanti-connect-secure-vpn/
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance