LIGHTWIRE

MITRE
Malware Type:
Other
First seen:
Unknown
Last seen:
Unknown
Details:

[LIGHTWIRE](https://attack.mitre.org/software/S1119) is a web shell written in Perl that was used during [Cutting Edge](https://attack.mitre.org/campaigns/C0029) to maintain access and enable command execution by imbedding into the legitimate compcheckresult.cgi component of Ivanti Secure Connect VPNs.(Citation: Mandiant Cutting Edge Part 2 January 2024)(Citation: Mandiant Cutting Edge January 2024)

Associated Techniques (5)
ID ATT&CK Tactics
T1071.001 Web Protocols -
T1140 Deobfuscate/Decode Files or Information -
T1505.003 Web Shell -
T1554 Compromise Host Software Binary -
T1573.001 Symmetric Cryptography -
Metadata
ID: 273
Created: 13/01/2026 17:48
Updated: 21/04/2026 04:00