DRYHOOKS9013 ↗
Has modified the Ivanti Connect Secure VPN authentication Perl module DSAuth.pm by reading its contents in the buffer, then finding and replacing select lines of code.12
tfMITRE ATT&CK technique
Modify System Image T1601
- Tactic
- Defense Impairment
- Platform
- Network Devices
- Version
- 2.0
- Created
- 19 October 2020
- Last modified
- 12 May 2026
Sub-techniques 21 rules across the family · 0 mapped directly to T1601 · 1 of 2 carry rules
Adversaries may make changes to the operating system of embedded network devices to weaken defenses and provide new capabilities for themselves. On such devices, the operating systems are typically monolithic and most of the device functionality and capabilities are contained within a single file.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
0
Threat groupsNone recorded
Threat groupsNone recorded · 29% of ATT&CK techniques have none either.0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.1
Tools & malware44th pct
Tools & malware44th percentile · 56% of ATT&CK techniques have more tools implementing them.0
Detection rulesNone recorded
Detection rulesNone recorded · 32% of ATT&CK techniques have none either.