Threat Group Cards: A Threat Actor Encyclopedia
Archived: 2026-04-05 17:07:25 UTC
Home > List all groups > List all tools > List all groups using tool LIGHTWIRE
 Tool: LIGHTWIRE
Names LIGHTWIRE
Category Malware
Type Backdoor
Description
(Mandiant) LIGHTWIRE is a web shell written in Perl CGI that is embedded into a
legitimate Secure Connect file to enable arbitrary command execution.
Information <https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day>
MITRE ATT&CK <https://attack.mitre.org/software/S1119>
Last change to this tool card: 19 June 2024
Download this tool card in JSON format
All groups using tool LIGHTWIRE
Changed Name Country Observed
APT groups
  UNC5221, UTA0178 2022-Mar 2025  
1 group listed (1 APT, 0 other, 0 unknown)
Source: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=1a15e1c6-a5a5-4653-a020-c7112bc23207
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=1a15e1c6-a5a5-4653-a020-c7112bc23207
Page 1 of 1