Routers, firewalls and VPN gateways sit outside the reach of endpoint detection, so implants placed on them can run for years while the device keeps forwarding traffic normally. MITRE ATT&CK Enterprise v20 catalogues 26 software entries that NHI Mgmt Group groups as network device malware: backdoors, credential stealers, droppers and packet capture tools built for Cisco, Fortinet, Ivanti and Pulse Secure, Juniper, Palo Alto Networks and SOHO devices. This hub lists every one of them with platforms, associated groups and distinctive techniques, summarises the behaviours they share, and turns those into detection and hardening themes that do not depend on an EDR agent. It is for network security engineers, detection engineers and incident responders. Web shells on the same appliances have their own hub, and investigation and replacement steps are in the linked playbooks.
Key takeaways
- 25 of 26 entries target Network Devices. In ATT&CK v20, 25 entries list the Network Devices platform and 11 also list Linux, reflecting the Linux base of most modern appliances.
- Passive backdoors dominate. Several entries listen for a "magic" packet or port knock rather than calling out (SYNful Knock, cd00r, J-magic, ZIPLINE, BRUSHFIRE, CASTLETAP), so outbound C2 hunting alone misses them.
- Implants turn off the evidence. Six entries map to T1685 Disable or Modify Tools and seven to T1070.004 File Deletion; Line Dancer disables syslog and blocks crash dumps.
- Credentials are the real target. PACEMAKER, WARPWIRE, DRYHOOK and SLOWPULSE capture or bypass VPN authentication, and six entries sniff traffic, so device compromise is always a credential incident.
- Integrity and configuration baselines replace EDR. Vendor integrity tools, memory region checks and configuration drift detection are the controls that found most of these families.
What sits in this category
ATT&CK assigns each software entry to platforms and to the groups and campaigns that used it. The hub assignment and the sub-groups below are an NHI Mgmt Group reading of the v20 descriptions, not a MITRE classification.
| Sub-group | Members | Target platforms |
|---|---|---|
| Pulse Secure, Ivanti and UNC5221-linked implants | SLOWPULSE, PACEMAKER, ZIPLINE, WARPWIRE, LITTLELAMB.WOOLTEA, PITSTOP, PHASEJAM, DRYHOOK, SPAWNCHIMERA, TRAILBLAZE, BRUSHFIRE | Pulse Secure and Ivanti Connect Secure VPN appliances, plus in-memory tools linked in their descriptions to the same actors |
| Firewall implants | COATHANGER, BOLDMOVE, THINCRUST, CASTLETAP, UPSTYLE, Line Dancer | FortiGate, PAN-OS GlobalProtect, Cisco ASA |
| Router and OS image implants | SYNful Knock, J-magic, cd00r, QUIETEXIT, JumbledPath | Cisco IOS routers, Juniper routers, opaque appliances |
| SOHO, modem and IoT malware | Cyclops Blink, AcidRain, IOControl | WatchGuard and Asus devices, MIPS modems and routers, Linux ARM IoT and OT devices |
| Cross-platform backdoor | BRICKSTORM | Network devices, Linux, ESXi and Windows |
BRICKSTORM is listed here because v20 gives it the Network Devices platform; it also matters for virtualisation estates, covered in the ATT&CK Linux, Cloud and ESXi Malware Software Hub. For the web shells on the same appliances (BUSHWALK, LIGHTWIRE, Line Runner and others) see the ATT&CK Web Shells Software Hub.
Shared behaviours across the 26 entries
Counts are computed from the current "uses" relationships between these 26 entries and techniques in ATT&CK Enterprise v20 (revoked and deprecated objects excluded).
| Technique | Entries using it | Defender meaning |
|---|---|---|
| T1140 Deobfuscate/Decode Files or Information | 12 | Encoded configuration and payloads decoded only on the device |
| T1059.004 Unix Shell | 8 | Shell scripts and commands run beneath the vendor CLI (PHASEJAM is itself a bash dropper); baseline what the vendor's own processes run |
| T1573.002 Asymmetric Cryptography | 8 | Encrypted C2 that network signatures cannot read |
| T1083 File and Directory Discovery and T1057 Process Discovery | 8 and 7 | Implants checking where they are and what runs beside them |
| T1070.004 File Deletion | 7 | Droppers and loaders removed after use |
| T1040 Network Sniffing | 6 | Packet capture on the device itself (JumbledPath, Line Dancer, CASTLETAP, cd00r, J-magic, SPAWNCHIMERA). See MITRE ATT&CK T1040 Network Sniffing. |
| T1685 Disable or Modify Tools | 6 | Logging, integrity checkers or security processes switched off. See T1685 Disable or Modify Tools Defensive Guide. |
| T1554 Compromise Host Software Binary | 5 | Vendor files modified to persist across upgrades. See MITRE ATT&CK T1554 Compromise Host Software Binary. |
| T1205 Traffic Signaling and T1205.001 Port Knocking | 5 together | Passive backdoors woken by crafted packets. See MITRE ATT&CK T1205 Traffic Signaling. |
| T1556.004 Network Device Authentication | 3 | Authentication bypass or hard-coded passwords (SYNful Knock, SLOWPULSE, DRYHOOK). See MITRE ATT&CK T1556 Modify Authentication Process Guide. |
SYNful Knock is the only entry mapped to T1601.001 Patch System Image, the oldest pattern in the category: a modified router operating system image rather than an added process.
Complete catalogue: all 26 network device malware entries in ATT&CK v20
Every entry assigned to this hub, in ATT&CK ID order. "Associated groups and campaigns" shows up to three current group or campaign relationships in v20, linking a live NHI Mgmt Group actor profile where one exists. "Techniques" is the count of current technique relationships, and "Distinctive techniques" lists each entry's least common techniques within this category.
| ID | Name | Type | Platforms | Associated groups and campaigns | Techniques | Distinctive techniques |
|---|---|---|---|---|---|---|
| S0519 | SYNful Knock | Malware | Network Devices | No group relationship in v20 | 3 | T1601.001 Patch System Image; T1556.004 Network Device Authentication; T1205 Traffic Signaling |
| S0687 | Cyclops Blink | Malware | Network Devices | Sandworm Team (G0034) | 21 | T1132.002 Non-Standard Encoding; T1542.002 Component Firmware; T1686.002 Network Device Firewall |
| S1084 | QUIETEXIT | Malware | Network Devices | APT29 (G0016) | 5 | T1008 Fallback Channels; T1071 Application Layer Protocol; T1090.002 External Proxy |
| S1104 | SLOWPULSE | Malware | Network Devices | APT5 (G1023) | 6 | T1111 Multi-Factor Authentication Interception; T1556.006 Multi-Factor Authentication; T1027 Obfuscated Files or Information |
| S1105 | COATHANGER | Malware | Linux, Network Devices | No group relationship in v20 | 18 | T1055 Process Injection; T1543.004 Launch Daemon; T1564.001 Hidden Files and Directories |
| S1109 | PACEMAKER | Malware | Network Devices, Linux | APT5 (G1023) | 6 | T1003.007 Proc Filesystem; T1055.008 Ptrace System Calls; T1119 Automated Collection |
| S1114 | ZIPLINE | Malware | Network Devices | Cutting Edge (C0029) | 9 | T1090 Proxy; T1573.001 Symmetric Cryptography; T1205 Traffic Signaling |
| S1116 | WARPWIRE | Malware | Network Devices | Cutting Edge (C0029) | 5 | T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol; T1056.003 Web Portal Capture; T1059.007 JavaScript |
| S1121 | LITTLELAMB.WOOLTEA | Malware | Network Devices | Cutting Edge (C0029) | 7 | T1090 Proxy; T1543 Create or Modify System Process; T1554 Compromise Host Software Binary |
| S1123 | PITSTOP | Malware | Network Devices | Cutting Edge (C0029) | 5 | T1205.002 Socket Filters; T1559 Inter-Process Communication; T1059.004 Unix Shell |
| S1125 | AcidRain | Malware | Network Devices, Linux | Sandworm Team (G0034) | 4 | T1485 Data Destruction; T1529 System Shutdown/Reboot; T1561.001 Disk Content Wipe |
| S1164 | UPSTYLE | Malware | Network Devices, Linux | Operation MidnightEclipse (C0048) | 12 | T1001.001 Junk Data; T1036 Masquerading; T1102.003 One-Way Communication |
| S1184 | BOLDMOVE | Malware | Linux, Network Devices | No group relationship in v20 | 14 | T1480 Execution Guardrails; T1564.011 Ignore Process Interrupts; T1090.003 Multi-hop Proxy |
| S1186 | Line Dancer | Malware | Network Devices | ArcaneDoor (C0046) | 9 | T1653 Power Settings; T1014 Rootkit; T1059.008 Network Device CLI |
| S1203 | J-magic | Malware | Network Devices | J-magic Campaign (C0050) | 8 | T1070.003 Clear Command History; T1016 System Network Configuration Discovery; T1036.005 Match Legitimate Resource Name or Location |
| S1204 | cd00r | Malware | Network Devices | No group relationship in v20 | 4 | T1205.001 Port Knocking; T1016 System Network Configuration Discovery; T1040 Network Sniffing |
| S1206 | JumbledPath | Malware | Network Devices | Salt Typhoon (G1045) | 6 | T1104 Multi-Stage Channels; T1560 Archive Collected Data; T1665 Hide Infrastructure |
| S1223 | THINCRUST | Malware | Network Devices | UNC3886 (G1048) | 5 | T1686 Disable or Modify System Firewall; T1573.001 Symmetric Cryptography; T1059.006 Python |
| S1224 | CASTLETAP | Malware | Network Devices | UNC3886 (G1048) | 8 | T1205.002 Socket Filters; T1573.001 Symmetric Cryptography; T1005 Data from Local System |
| S9011 | BRUSHFIRE | Malware | Linux, Network Devices | No group relationship in v20 | 4 | T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol; T1620 Reflective Code Loading; T1205 Traffic Signaling |
| S9012 | TRAILBLAZE | Malware | Linux, Network Devices | No group relationship in v20 | 4 | T1055.012 Process Hollowing; T1106 Native API; T1057 Process Discovery |
| S9013 | DRYHOOK | Malware | Linux, Network Devices | No group relationship in v20 | 11 | T1056.001 Keylogging; T1556 Modify Authentication Process; T1601 Modify System Image |
| S9014 | PHASEJAM | Malware | Linux, Network Devices | No group relationship in v20 | 15 | T1027.010 Command Obfuscation; T1036.003 Rename Legitimate Utilities; T1546.004 Unix Shell Configuration Modification |
| S9015 | BRICKSTORM | Malware | ESXi, Linux, Network Devices, Windows | No group relationship in v20 | 25 | T1070.010 Relocate Malware; T1071.004 DNS; T1090.001 Internal Proxy |
| S9024 | SPAWNCHIMERA | Malware | Linux, Network Devices | No group relationship in v20 | 23 | T1037 Boot or Logon Initialization Scripts; T1055.002 Portable Executable Injection; T1480.002 Mutual Exclusion |
| S9046 | IOControl | Malware | None listed in v20 (Linux ARM IoT and OT devices per its description) | No group relationship in v20 | 9 | T1033 System Owner/User Discovery; T1070.009 Clear Persistence; T1124 System Time Discovery |
Eleven entries have no group or campaign relationship in v20, but several descriptions name actors: BOLDMOVE and COATHANGER are linked to People's Republic of China operations, UPSTYLE to the actor Volexity tracks as UTA0218, TRAILBLAZE, BRUSHFIRE, PHASEJAM and DRYHOOK to UNC5221 and others, and IOControl to CyberAv3ngers, which ATT&CK describes as suspected to be affiliated with the IRGC.
Real cases that shaped the category
ArcaneDoor: Cisco ASA, 2024 and 2025
Cisco Talos reported in April 2024 that an actor it tracks as UAT4356 (Microsoft: STORM-1849) used Line Dancer, a memory-only shellcode interpreter, and Line Runner, a Lua-based persistence mechanism, against Cisco ASA devices on government networks. Line Dancer disabled syslog, captured packets and hooked the crash dump process so a reboot left no dump. Line Runner abused a legacy VPN client pre-loading feature to survive reboots and upgrades. Talos assessed with high confidence that the actor is state-sponsored, and its September 2025 update tied new ASA 5500-X activity to the same actor. Its detection advice included checking show memory region | include lina for more than one executable region, looking for unexpected ZIP files on disk0, and not collecting a core dump or rebooting a suspect device before memory is preserved.
Cutting Edge and its successors: Ivanti Connect Secure
ZIPLINE, WARPWIRE, LITTLELAMB.WOOLTEA and PITSTOP are linked in v20 to the Cutting Edge campaign, and Mandiant described WARPWIRE as JavaScript injected into the login page to capture plaintext usernames and passwords. The Ivanti Connect Secure exploitation breach page covers the credential fallout; see also the UNC5221 (Ivanti exploitation) threat actor profile.
COATHANGER: FortiGate, 2022 to 2024
The Dutch NCSC, MIVD and AIVD reported that a Chinese state actor reached at least 20,000 FortiGate systems worldwide in 2022 and 2023 through CVE-2022-42475, about 14,000 of them during the zero-day period, and installed COATHANGER on selected targets for access that persisted after security updates. Their advice was to assume breach and invest in segmentation, detection, incident response planning and forensic readiness, noting that edge devices are often outside EDR coverage.
Operation MidnightEclipse: PAN-OS, April 2024
Unit 42 reported that exploitation of CVE-2024-3400 in GlobalProtect included attempts to install UPSTYLE, a Python backdoor that read commands from the sslvpn_ngx_error.log file and wrote output into a CSS file before restoring it. When installation failed, the actor copied running_config.xml to a web-accessible location and set up a cron job.
Salt Typhoon: telecom routers
Cisco Talos found that Salt Typhoon mostly entered with valid stolen device credentials and used JumbledPath to capture packets across chains of devices while clearing logs. The Salt Typhoon telecom intrusions breach page draws out the SNMP, TACACS and RADIUS secrets involved.
Detection themes without an EDR agent
| Signal | Source | What to alert on | Families it would surface |
|---|---|---|---|
| Integrity check failure | Vendor integrity tools (for example Ivanti's Integrity Checker Tool, Juniper's JMRT Integrity Check) | Any mismatch, manifest error, or a scheduled check that did not run | Implants that modify vendor files (SLOWPULSE, PHASEJAM, LITTLELAMB.WOOLTEA) |
| Image and memory verification | Image hash against vendor published values; vendor memory inspection commands | Hash mismatch or unexpected executable memory regions | SYNful Knock, Line Dancer |
| Logging gaps | SIEM ingestion health; device syslog | A device that stops sending logs, unexplained reboots, cleared logs | Line Dancer, JumbledPath, ZIPLINE |
| Configuration drift | Configuration management backups and diff | New local accounts, changed AAA or TACACS servers, new SSH keys, ACL or SNMP changes outside change windows | Credential-driven intrusions such as Salt Typhoon |
| Flows from the device | NetFlow or IPFIX upstream of the device | Management-plane connections to unknown hosts, TFTP or FTP exports of configurations, new listening ports, ICMP or TCP patterns resembling knocks | Passive backdoors and exfiltration |
| Authentication anomalies | AAA, RADIUS and VPN logs | Administrative logins from unusual sources, logins succeeding without the expected MFA step | SLOWPULSE, SYNful Knock, Line Dancer AAA hooks |
For the log sources themselves see the Network Device Syslog and Configuration Change Detection Guide; for a full investigation procedure see the Edge Device Compromise Investigation Playbook.
Hardening priorities
- Patch edge devices on the fastest track you run: almost every case above began with an exploited appliance flaw.
- Lock down the management plane: management interfaces only from a dedicated network, centralised AAA with MFA and role-based access, no shared local accounts. See the Network Device Management Plane Hardening Guide.
- Schedule integrity checks and keep known-good images: run vendor checks on a timetable and alert when they fail or do not run.
- Send logs off the device in real time: implants clear local logs, so the copy that matters is the one already in the SIEM.
- Plan for factory reset and replacement: several families persist through upgrades, so rebuild from a known-good image when compromise is confirmed, and retire end-of-life hardware. See the Edge Device End of Life Replacement Playbook.
- Preserve evidence first: follow vendor forensic procedures before rebooting or upgrading a suspect device, as Talos advised for ASA.
Introduce new alerts in a monitoring-only phase across a pilot group of devices, and keep configuration rollback ready for any hardening change that affects routing or VPN access.
Where identity fits
A network appliance stores more machine credentials than most servers: SNMP community strings, TACACS and RADIUS shared secrets, directory bind accounts, local administrator passwords, SSH keys and certificates. Credential stealers in this hub take user passwords at the VPN login, and configuration theft exposes the rest. When a device is compromised, rotate every secret it held and reset users who authenticated during the exposure window. See the Edge Device Exploitation by Threat Actors Guide for the identity consequences in detail.
Detection and measurement
- Integrity coverage: share of edge devices with a scheduled vendor integrity check and an alert on failure (target 100%).
- Log continuity: devices with a logging gap over one hour in the last 30 days.
- Patch latency: median days from vendor advisory to fix on internet-facing devices.
- Drift: unapproved configuration changes detected per month and time to review.
- Secret rotation: age of SNMP, TACACS and RADIUS shared secrets and local admin passwords.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| MITRE ATT&CK v20 | T1601.001 Patch System Image, T1556.004 Network Device Authentication, T1205, T1040, T1685 | Image tampering, authentication bypass, passive C2, sniffing, defence impairment |
| NIST SP 800-53 Rev. 5 | SI-7 Software, Firmware, and Information Integrity; CM-3 Configuration Change Control; AU-6 Audit Record Review, Analysis, and Reporting; IA-5 Authenticator Management | Image integrity, drift, log review, shared secret rotation |
| NIST CSF 2.0 | PR.PS-02; DE.CM-09 | Patch and monitor appliances |
| CIS Controls v8.1 | Control 4 Secure Configuration of Enterprise Assets and Software; Control 12 Network Infrastructure Management | Device hardening and management |
Practitioner checklist
- Inventory every edge device with model, software version and end-of-life date.
- Schedule vendor integrity checks and alert on failures and missed runs.
- Forward device logs off-box in real time and alert on gaps and unexplained reboots.
- Back up configurations and diff them against approved changes.
- Restrict management interfaces to a dedicated network with MFA through centralised AAA.
- Monitor flows from devices for unexpected management-plane destinations and configuration exports.
- Keep vendor forensic procedures at hand and preserve memory before rebooting a suspect device.
- Pre-plan rotation of every secret stored on each device.
Standards and references
- MITRE ATT&CK: Software
- MITRE ATT&CK: T1601.001 Modify System Image: Patch System Image
- Cisco Talos: ArcaneDoor, new espionage-focused campaign found targeting perimeter network devices
- Mandiant: Cutting Edge, Part 2: Investigating Ivanti Connect Secure VPN Zero-Day Exploitation
- NCSC-NL, MIVD and AIVD: COATHANGER advisory
- Palo Alto Networks Unit 42: Threat Brief, Operation MidnightEclipse and CVE-2024-3400
- Mandiant: China-nexus espionage actor targets Juniper routers
- NIST: SP 800-53 Rev. 5 Security and Privacy Controls
Related NHI Mgmt Group resources: Edge Device Exploitation by Threat Actors Guide · Edge Device Compromise Investigation Playbook · Edge Device End of Life Replacement Playbook · ATT&CK Web Shells Software Hub · UNC3886 Threat Actor Profile Guide