…ing arbitrary command execution on compromised Ivanti Connect Secure VPNs. [18] C0041 FrostyGoop Incident FrostyGoop Incident deployed a ReGeorg variant web shell to impacted systems following initial access for persistence. [31] G0093 GALLIUM GALLIUM used Web shells to persist i…

… used ports, and is frequently encapsulated by application layer protocols. [3] C0041 FrostyGoop Incident During FrostyGoop Incident , the adversary initiated Layer Two Tunnelling Protocol (L2TP) connections to Moscow-based IP addresses. [4] S0601 Hildegard Hildegard has used an …

…o victim environments by exploiting multiple known vulnerabilities over several campaigns. [97] [98] C0045 ShadowRay During ShadowRay , threat actors exploited CVE-2023-48022 on publicly exposed Ray servers to steal computing power and to expose sensitive data. [99] S0623 Silosca…