1. Home
  2. Software
  3. LITTLELAMB.WOOLTEA

LITTLELAMB.WOOLTEA

LITTLELAMB.WOOLTEA is a backdoor that was used by UNC5325 during Cutting Edge to deploy malware on targeted Ivanti Connect Secure VPNs and to establish persistence across system upgrades and patches.[1]

ID: S1121
ⓘ
Type: MALWARE
ⓘ
Platforms: Network
Version: 1.0
Created: 13 March 2024
Last Modified: 17 April 2024
Enterprise Layer
download view

Techniques Used

Domain ID Name Use
Enterprise T1554 主机软件二进制文件妥协

LITTLELAMB.WOOLTEA can append malicious components to the tmp/tmpmnt/bin/samba_upgrade.tar archive inside the factory reset partition in attempt to persist post reset.[1]
Enterprise T1090 代理

LITTLELAMB.WOOLTEA has the ability to function as a SOCKS proxy.[1]
Enterprise T1543 创建或修改系统进程

LITTLELAMB.WOOLTEA can initialize itself as a daemon to run persistently in the background.[1]
Enterprise T1573 .002 加密通道: Asymmetric Cryptography

LITTLELAMB.WOOLTEA can communicate over SSL using the private key from the Ivanti Connect Secure web server.[1]
Enterprise T1083 文件和目录发现

LITTLELAMB.WOOLTEA can monitor for system upgrade events by checking for the presence of /tmp/data/root/dev.[1]
Enterprise T1082 系统信息发现

LITTLELAMB.WOOLTEA can check the type of Ivanti VPN device it is running on by executing first_run() to identify the first four bytes of the motherboard serial number.[1]
Enterprise T1095 非应用层协议

LITTLELAMB.WOOLTEA can function as a stand-alone backdoor communicating over the /tmp/clientsDownload.sock socket.[1]

Campaigns

ID Name Description
C0029 Cutting Edge

[1]

References

  1. Lin, M. et al. (2024, February 27). Cutting Edge, Part 3: Investigating Ivanti Connect Secure VPN Exploitation and Persistence Attempts. Retrieved March 1, 2024.