MalwareUsed by 1 actorExploits 3 CVEs

GIFTEDVISITOR

Also known asWIREFIRE

GIFTEDVISITOR, also known as WIREFIRE, is a Python web shell deployed on compromised Ivanti Connect Secure VPN appliances. It modifies a legitimate Python component of the appliance’s web application to provide persistent, HTTP-accessible command execution and file-transfer functionality. It supports uploading and downloading files, executing arbitrary commands, and returning Base64-encoded process output. Variants use AES encryption, with a variant observed during widespread exploitation using victim-specific keys derived from truncated UUID strings.

GIFTEDVISITOR was deployed following exploitation of CVE-2023-46805, an authentication-bypass vulnerability, chained with CVE-2024-21887, a command-injection vulnerability. It has been used in intrusions associated with UTA0178 and UNC5221, including the compromise of MITRE’s NERVE research environment. By January 16, 2024, more than 2,100 Ivanti Connect Secure appliances worldwide had been identified as infected. Affected organizations ranged from small businesses to Fortune 500 companies across government, military, telecommunications, defense, technology, finance, aerospace, and other sectors. The web shell provides continued access to compromised appliances for post-exploitation operations.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

3 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

3 CVES

CVE-2024-21887Command Injection in Ivanti Connect Secure and Policy SecureExploited in the wild

The paired CVE-2023-46805 and CVE-2024-21887 test sends {"type": ";id;"} to a maintenance endpoint. A second request to /api/v1/cav/client/visits contains GIFTEDVISITOR and attempts to trigger a webshell.

via handlers diary fullisc.sans.edu

CVE-2023-46805Authentication bypass in Ivanti Connect Secure and Policy SecureExploited in the wild

The author observed scans attempting to exploit CVE-2023-46805 and CVE-2024-21887, including a traversal-based request to a maintenance endpoint and a request attempting to trigger the GIFTEDVISITOR webshell.

via handlers diary fullisc.sans.edu

CVE-2024-21893Unauthenticated SAML SSRF in Ivanti Connect Secure, Policy Secure, and Neurons for ZTAExploited in the wild

Threat actors are exploiting previously identified vulnerabilities in Ivanti Connect Secure and Ivanti Policy Secure gateways, including CVE-2023-46805 (CVSS 8.2), CVE-2024-21887 (CVSS 9.1) and CVE-2024-21893 (CVSS 8.1).

via imda singaporeimda.gov.sg

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

UNC5221

The group has been observed using other distinct malware including CHAINLINE backdoor, FRAMESTING webshell, WIREFIRE webshell.

via polyswarmblog.polyswarm.io

MITRE ATT&CK

Techniques & procedures

17 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1190Exploit Public-Facing ApplicationEvidence3

Threat actors use custom web shells planted on public facing applications which allows persistence in victims’ environment.

Execution

5 techniques

T1059Command and Scripting InterpreterEvidence2

They function as dormant backdoors, activated only when attackers submit specific HTTP requests containing commands or credentials.

T1059.004Unix ShellEvidence1

the adversary executed suspicious Python scripts and /bin/sh commands from the /tmp directory

T1059.006PythonEvidence1

the adversary executed suspicious Python scripts... from the /tmp directory

T1203Exploitation for Client ExecutionEvidence1

“Cyber actors will exploit software vulnerabilities such as command-injection and achieve unauthenticated remote code execution (RCE).”

T1574Hijack Execution FlowEvidence1

During the 2016 Ukraine Electric Power Attack, Sandworm Team used a trojanized version of Windows Notepad to add a layer of persistence for Industroyer.

Persistence

2 techniques

T1505.003Web ShellEvidence8

Threat actors may use web shells on internal- and external-facing web servers to establish persistent access to systems.

T1554Compromise Host Software BinaryEvidence2

Stealth

2 techniques

T1140Deobfuscate/Decode Files or InformationEvidence5

The content repeatedly describes malware and threat actors decoding, decrypting, deobfuscating, or unpacking payloads, strings, configuration data, commands, and C2 responses prior to execution or use.

T1574Hijack Execution FlowEvidence1

During the 2016 Ukraine Electric Power Attack, Sandworm Team used a trojanized version of Windows Notepad to add a layer of persistence for Industroyer.

Collection

1 technique

T1560Archive Collected DataEvidence2

a base64 encoded logo.gif file was an exact copy of a log file on the system which the adversary exfiltrated

Command and Control

6 techniques

T1071Application Layer ProtocolEvidence1

BEEFLUSH ... communicated with several internal IP addresses making POST requests.

T1071.001Web ProtocolsEvidence4

The content repeatedly describes threat actors, malware, and campaigns using HTTP and/or HTTPS for command and control, including examples such as BlackEnergy communicating with C2 over HTTP POST requests and many other families using HTTP/S for C2.

T1105Ingress Tool TransferEvidence3

The adversary uploaded a Python script, visits.py, that contained the WIREFIRE (aka GIFTEDVISITOR) web shell

T1132Data EncodingEvidence2

C2 traffic from ADVSTORESHELL is encrypted, then encoded with Base64 encoding... APT19 HTTP malware variant used Base64 to encode communications to the C2 server... APT33 has used base64 to encode command and control traffic.

T1132.001Standard EncodingEvidence2

T1573.001Symmetric CryptographyEvidence2

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence2

The adversary exfiltrated data from the NERVE using command-and-control infrastructure.

INDICATORS OF COMPROMISE

IOCs tracked for this family

2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

1 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

1 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app3 years ago

hash.sha256●●●●●●●●●●●●View more in app3 years ago

ACTIVITY FEED

Recent activity

16 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

16 SOURCESView more in app

polyswarmNews

Oct 5, 2026

KrustyLoader Backdoor

Webshell mentioned as part of UNC5221's broader malware arsenal; no operational details are provided.

northwaveNews

Jan 1, 2026

Investigating a possible Ivanti compromise

A webshell identified on more than 2,100 compromised Ivanti devices. It is mentioned as context for exploitation affecting Ivanti appliances; the excerpt does not detail its capabilities.

recordedfutureNews

Jul 28, 2025

Why Patch Management Isn’t Enough: SharePoint, Webshells & the Modern Threat Landscape

A webshell used to maintain access on compromised Ivanti Connect Secure VPN devices.

handlers diary fullNews

Oct 27, 2024

Two currently (old) exploited Ivanti vulnerabilities

A webshell associated with exploitation of Ivanti vulnerabilities CVE-2023-46805 and CVE-2024-21887. The observed honeypot request attempts to trigger it by posting the string GIFTEDVISITOR to /api/v1/cav/client/visits. The content documents an attempted trigger, not a confirmed infection or successful execution.

+9 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching2

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities3

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping17

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

GIFTEDVISITOR

Also known asWIREFIRE