MalwareUsed by 1 actorExploits 1 CVE

PITSTOP

PITSTOP is malware observed in exploitation of Ivanti Connect Secure appliances by UNC5325, a suspected Chinese espionage operator. Mandiant reported UNC5325 deploying PITSTOP alongside LITTLELAMB.WOOLTEA, PITDOG, PITJET, and PITHOOK during activity involving exploitation of Ivanti vulnerabilities including CVE-2024-21893, often chained with CVE-2024-21887. High-confidence behavior described for PITSTOP includes communication over TLS and listening on a Unix domain socket at /data/runtime/cockpit/wd.fd, indicating use of encrypted communications and local inter-process communication on compromised appliances. The broader UNC5325 activity targeted Ivanti appliances across multiple industry verticals, including the U.S. defense industrial base, and involved attempts to establish persistence and evade detection using custom malware and living-off-the-land techniques.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

1 CVES

CVE-2024-21893SSRF Authentication Bypass in Ivanti Connect Secure SAMLExploited in the wild

Mandiant observed ... development of a mitigation bypass exploit targeting CVE-2024-21893 ... The mitigation bypass is now tracked as CVE-2024-21893. It is a server-side request forgery (SSRF) vulnerability in the SAML component of Ivanti Connect Secure (CS), Policy Secure (PS), and Neurons for Zero Trust Access (NZTA) appliances... Mandiant identified active exploitation of CVE-2024-21893 by UNC5325 as early as Jan. 19, 2024... threat actors chaining the SSRF vulnerability with ... CVE-2024-21887...

via mandiant threat intelligencecloud.google.com

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

UNC5325

UNC5325 has been observed deploying LITTLELAMB.WOOLTEA, PITSTOP, PITDOG, PITJET, and PITHOOK.

via mandiant threat intelligencecloud.google.com

MITRE ATT&CK

Techniques & procedures

8 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1190Exploit Public-Facing ApplicationEvidence1

"Mandiant identified active exploitation of CVE-2024-21893 by UNC5325... targeting... Ivanti Connect Secure appliances."

Execution

2 techniques

T1059.004Unix ShellEvidence1

T1559Inter-Process CommunicationEvidence1

Persistence

1 technique

T1205.002Socket FiltersEvidence1

Stealth

2 techniques

T1140Deobfuscate/Decode Files or InformationEvidence4

The content repeatedly describes malware and threat actors decoding, decrypting, deobfuscating, or unpacking payloads, strings, configuration data, commands, and C2 responses prior to execution or use.

T1205.002Socket FiltersEvidence1

Command and Control

3 techniques

T1205.002Socket FiltersEvidence1

T1573Encrypted ChannelEvidence1

The content repeatedly describes malware and threat actors using SSL, TLS, HTTPS, RSA, AES, Blowfish, RC4, ECIES, Diffie-Hellman, OpenSSL, WolfSSL, and mutual TLS to protect command and control traffic.

T1573.002Asymmetric CryptographyEvidence2

Multiple malware families and intrusion sets are described as encrypting C2 traffic using SSL/TLS/HTTPS (e.g., "used HTTPS for command and control", "encrypts C2 communications with TLS", "uses SSL for encrypting C2 communications", "TLS-encrypted WebSocket Protocol (WSS) for C2").

Other

1 technique

T1562.001Disable or Modify ToolsEvidence1

"...modified the appliance's settings in order to evade detection and attempt to maintain persistence."

ACTIVITY FEED

Recent activity

6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

6 SOURCESView more in app

mitre attack websiteNews

Jan 1, 2024

Inter-Process Communication, Technique T1559 - Enterprise | MITRE ATT&CK®

Backdoor that listens on a Unix domain socket for communication.

mitre attack websiteNews

Aug 1, 2017

Encrypted Channel: Asymmetric Cryptography, Sub-technique T1573.002 - Enterprise | MITRE ATT&CK®

Malware that can communicate over TLS.

mitre attackNews

Jan 24, 2026

Inter-Process Communication, Technique T1559 - Enterprise | MITRE ATT&CK®

Malware that listens over a Unix domain socket for local IPC.

mitre attackNews

Jan 25, 2026

Encrypted Channel: Asymmetric Cryptography, Sub-technique T1573.002 - Enterprise | MITRE ATT&CK®

Can communicate over TLS.

+1 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities1

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping8

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

PITSTOP