H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Malware

PITSTOP

[PITSTOP](https://attack.mitre.org/software/S1123) is a backdoor that was deployed on compromised Ivanti Connect Secure VPNs during [Cutting Edge](https://attack.mitre.org/campaigns/C0029) to enable command execution and file read/write.(Citation: Mandiant Cutting Edge Part 3 February 2024)

Malware
TypeMalware
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[PITSTOP](https://attack.mitre.org/software/S1123) is a backdoor that was deployed on compromised Ivanti Connect Secure VPNs during [Cutting Edge](https://attack.mitre.org/campaigns/C0029) to enable command execution and file read/write.(Citation: Mandiant Cutting Edge Part 3 February 2024)

Labels

malware
6 recorded

Relationships

uses
from Cutting Edge
Campaign
uses
to Asymmetric Cryptography
Technique
uses
to Deobfuscate/Decode Files or Information
Technique
uses
to Inter-Process Communication
Technique
uses
to Socket Filters
Technique
uses
to Unix Shell
Technique
2 external

References

mitre-attack
S1123
open
Mandiant Cutting Edge Part 3 February 2024
https://www.mandiant.com/resources/blog/investigating-ivanti-exploitation-persistence
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance