ZIPLINE
MITRE ATT&CK: S1114 View on attack.mitre.org
Aliases: ZIPLINE
- First seen
- 2023-02-01 00:00:00
- Malware type
- backdoor
- Family
- Malware family
- Operating systems
- network-devices
- Last IoC activity
- 2026-07-18 22:54:55
- Profile updated
- 2026-07-07 13:11:04
Targeted industries: government-and-public-sector technology-and-telecommunications
Targeted regions: country_code:us country_code:cn
Context
ZIPLINE is a passive backdoor that was used during Cutting Edge on compromised Secure Connect VPNs for reverse shell and proxy functionality.
Detection coverage
- 1 YARA rules
- 292 Sigma rules
Malware & tools used
- Proxy (attack-pattern)
- Process Discovery (attack-pattern)
- Traffic Signaling (attack-pattern)
- Non-Application Layer Protocol (attack-pattern)
- Symmetric Cryptography (attack-pattern)
- Unix Shell (attack-pattern)
- File and Directory Discovery (attack-pattern)
- Ingress Tool Transfer (attack-pattern)
- Disable or Modify Tools (attack-pattern)
Used by threat actors
- Cutting Edge (campaign)
Detection rules
- SIGNATURE_BASE_M_Hunting_Backdoor_ZIPLINE_1 (yara-rule)
Reports & references
- Mandiant — Suspected Apt Targets Ivanti Zero Day (report)
- MITRE ATT&CK — S1114 (report)