สำนักงานพัฒนาธุรกรรมทางอิเล็กทรอนิกส์
Electronic Transactions Development Agency

Report

Home > List all groups > List all tools > List all groups using tool GIFTEDVISITOR

Threat Group Cards: A Threat Actor Encyclopedia

Tool: GIFTEDVISITOR

Names	GIFTEDVISITOR
Category	Malware
Type	Backdoor
Description	(Volexity) The attacker also modified another inbuilt component of Ivanti Connect Secure named visits.py adding a webshell component Volexity refers to as GIFTEDVISITOR. The code in this function is called whenever users access /api/v1/cav/client/visits. The modification to this code was to add the following additional code to the handler for POST requests.
Information	<https://www.volexity.com/blog/2024/01/10/active-exploitation-of-two-zero-day-vulnerabilities-in-ivanti-connect-secure-vpn/> <https://www.volexity.com/blog/2024/01/15/ivanti-connect-secure-vpn-exploitation-goes-global/>
MITRE ATT&CK	<https://attack.mitre.org/software/S1115>

Last change to this tool card: 27 August 2024

Download this tool card in JSON format

All groups using tool GIFTEDVISITOR

Changed	Name	Country	Observed
APT groups
	UNC5221, UTA0178	[Unknown]	2023

1 group listed (1 APT, 0 other, 0 unknown)

Digital Service Security Center
Electronic Transactions Development Agency

Follow us on

Report incidents

+66 (0)2-123-1227

[email protected]