During Cutting Edge, threat actors used Task Manager to dump LSASS memory from Windows devices to disk.6
campaign
Cutting Edge C0029
- First seen
- December 2023
- Last seen
- February 2024
- Created
- 1 March 2024
- Last modified
- 31 July 2026
Cutting Edge was a campaign conducted by suspected China-nexus espionage actors, variously identified as UNC5221/UTA0178 and UNC5325, that began as early as December 2023 with the exploitation of zero-day vulnerabilities in Ivanti Connect Secure (previously Pulse Secure) VPN appliances. Cutting Edge targeted the U.S. defense industrial base and multiple sectors globally including telecommunications, financial, aerospace, and technology. Cutting Edge featured the use of defense evasion and living-off-the-land (LoTL) techniques along with the deployment of web shells and other custom malware.[1][2][3][4][5]
31
TechniquesTop 12%
13
TacticsTop 11%
11
Tools & malwareTop 1%
0
Threat groupsNone recorded
Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.
MITRE reference C0029
During Cutting Edge, threat actors accessed and mounted virtual hard disk backups to extract ntds.dit.7
During Cutting Edge, threat actors stole the running configuration and cache data from targeted Ivanti Connect Secure VPNs.89
During Cutting Edge, threat actors used RDP with compromised credentials for lateral movement.10
During Cutting Edge, threat actors moved laterally using compromised credentials to connect to internal Windows systems with SMB.11
During Cutting Edge, threat actors used SSH for lateral movement.12
Standing C0029
Reach is how much of ATT&CK this campaign touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 56 ATT&CK campaigns only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.
Reach
Techniques31Top 12%
88th percentile · 88% of 56 ATT&CK campaigns have this many Enterprise techniques or fewer.
Tactics13Top 11%
89th percentile · 89% of 56 ATT&CK campaigns have this many tactics spanned or fewer.
Tools & malware11Top 1%
100th percentile · None of the 56 ATT&CK campaigns has more tools and malware — the highest in the population.
Threat groups055% tie · 3 values
55% of the population shares a single value across only 3 distinct values, so a percentile here would rank the tie, not the entity.
Coverage
Rules / technique24med73rd pct
73rd percentile · 73% of 56 ATT&CK campaigns have this many detection rules per technique or fewer.
Tests / technique4
Detection coverage C0029
1371 distinct rules cover the 31 techniques recorded for this campaign. The 1465 technique-to-rule mappings resolve to 1371 distinct rules, because one rule can cover several techniques. 890 Sigma · 481 Splunk.
27 covered by at least one rule4 with no coverage1371 distinct rules in total
tf
Loading...Drag headers to reorder | Drag edges to resize
tf
Loading detections...
| Select | Title | Description | Category | Status | Event | Product | MITRE ATT&CK | CVEs | Severity | Author | Created | Updated | ID | Refs |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
© 2026 The MITRE Corporation. ATT&CK® and D3FEND™ data reproduced with permission. SigmaHQ detection rules licensed under DRL 1.1. attack.mitre.org · d3fend.mitre.org · CAR analytics licensed under Apache 2.0 · car.mitre.org