Loading malware…
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
This early intrusion leveraged multiple Ivanti Connect Secure zero-day vulnerabilities (CVE-2023–46805 and CVE-2024–21887) for unauthorized access before the initial disclosure of vulnerabilities on January 10th and before patches were available. | The adversary deployed the ROOTROT web shell on an external-facing Ivanti appliance... ROOTROT Web shell is written in Perl and is embedded into a legitimate Connect Secure .ttc file.
This early intrusion leveraged multiple Ivanti Connect Secure zero-day vulnerabilities (CVE-2023–46805 and CVE-2024–21887) for unauthorized access before the initial disclosure of vulnerabilities on January 10th and before patches were available. | The adversary deployed the ROOTROT web shell on an external-facing Ivanti appliance... ROOTROT Web shell is written in Perl and is embedded into a legitimate Connect Secure .ttc file.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The adversary deployed the ROOTROT web shell on an external-facing Ivanti appliance... ROOTROT Web shell is written in Perl and is embedded into a legitimate Connect Secure .ttc file.
3 distinct techniques documented for this family, organized by ATT&CK tactic.
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
RootRot is a backdoor targeting Ivanti Control, used by APT actors for persistent access and control in targeted environments.
A Perl-based web shell embedded in a legitimate Connect Secure .ttc file that accepts Base64-encoded commands via the web interface and executes them with eval, enabling reconnaissance and lateral movement.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.