Cyberattack, Detection, Adversary Engagement, Threat Intelligence, Threat Informed Defense.
adversary uploaded a Python script, visits.py, that contained the WIREFIRE (aka GIFTEDVISITOR) web shell on the Ivanti appliance within the /home/venv3/lib/Python3.6/site-packages/cav-0.1-py3.6.egg archive file. The deployment of web shells facilitates covert communication and data exfiltration,