Cutting Edge
Campaign · ATTACK:enterprise:C0029
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:C0029",
"title": "Cutting Edge",
"type": "Campaign",
"source_url": "https://attack.mitre.org/campaigns/C0029",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "campaign--4fdd2487-26c1-494e-8702-ec5abe9aa1d9",
"external_id": "C0029",
"domain": "enterprise",
"created": "2024-03-01T18:21:04.698Z",
"modified": "2026-07-31T18:47:22.237Z",
"version": "1.0",
"aliases": [
"Cutting Edge"
],
"tactics": [
],
"source_references": [
{
"source_name": "Volexity Ivanti Global Exploitation January 2024",
"url": "https://www.volexity.com/blog/2024/01/15/ivanti-connect-secure-vpn-exploitation-goes-global/"
},
{
"source_name": "Mandiant Cutting Edge Part 3 February 2024",
"url": "https://www.mandiant.com/resources/blog/investigating-ivanti-exploitation-persistence"
},
{
"source_name": "Mandiant Cutting Edge Part 2 January 2024",
"url": "https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation"
},
{
"source_name": "Mandiant Cutting Edge January 2024",
"url": "https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day"
},
{
"source_name": "Volexity Ivanti Zero-Day Exploitation January 2024",
"url": "https://www.volexity.com/blog/2024/01/10/active-exploitation-of-two-zero-day-vulnerabilities-in-ivanti-connect-secure-vpn/"
}
]
}Explicit source assertions (42)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:C0029 → uses → ATTACK:enterprise:T1595.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1509c545-be16-42be-8ec8-140b13f74555
Mandiant Cutting Edge Part 3 February 2024ATTACK:enterprise:C0029 → uses → ATTACK:enterprise:T1205
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--15c274dd-c045-43d6-a038-fa969dd04c8d
Mandiant Cutting Edge Part 3 February 2024ATTACK:enterprise:C0029 → uses → ATTACK:enterprise:T1685
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--217968e0-0c70-4f57-a2e6-5add0bc51a11
Mandiant Cutting Edge Part 2 January 2024 · Volexity Ivanti Zero-Day Exploitation January 2024ATTACK:enterprise:C0029 → uses → ATTACK:enterprise:T1070
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--25c038d5-7cba-4416-ac10-f1c893942042
Mandiant Cutting Edge Part 2 January 2024 · Volexity Ivanti Zero-Day Exploitation January 2024ATTACK:enterprise:C0029 → uses → ATTACK:enterprise:S1116
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2b7227b7-70ad-43b8-8f2e-ec0d9c5b8929
Volexity Ivanti Global Exploitation January 2024 · Mandiant Cutting Edge January 2024 · Volexity Ivanti Zero-Day Exploitation January 2024ATTACK:enterprise:C0029 → uses → ATTACK:enterprise:T1003.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2b7df536-1a64-487a-9588-42f3bd411f3f
Volexity Ivanti Zero-Day Exploitation January 2024ATTACK:enterprise:C0029 → uses → ATTACK:enterprise:T1055
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2f0bcef1-1f30-4585-b158-25d614f5f350
Mandiant Cutting Edge Part 3 February 2024ATTACK:enterprise:C0029 → uses → ATTACK:enterprise:T1021.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--303221b5-f6eb-4fa2-b9d6-dd6d856dd79e
Volexity Ivanti Zero-Day Exploitation January 2024ATTACK:enterprise:C0029 → uses → ATTACK:enterprise:T1070.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--32621114-725a-4766-b057-2d091adba75b
Mandiant Cutting Edge Part 3 February 2024 · Mandiant Cutting Edge Part 2 January 2024ATTACK:enterprise:C0029 → uses → ATTACK:enterprise:T1059
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4827d600-cf36-48c8-ba73-46d89d34143b
Mandiant Cutting Edge Part 2 January 2024 · Mandiant Cutting Edge January 2024ATTACK:enterprise:C0029 → uses → ATTACK:enterprise:T1070.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4b688df5-5ecf-48ea-a15f-4509e557224c
Mandiant Cutting Edge Part 3 February 2024 · Mandiant Cutting Edge Part 2 January 2024ATTACK:enterprise:C0029 → uses → ATTACK:enterprise:S1121
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4dec5e5f-9136-4ebe-9888-b2d55c0f9f9c
Mandiant Cutting Edge Part 3 February 2024ATTACK:enterprise:C0029 → uses → ATTACK:enterprise:T1071.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4f27c041-e965-4ee3-b47c-6681e7fc1ace
Mandiant Cutting Edge Part 2 January 2024ATTACK:enterprise:C0029 → uses → ATTACK:enterprise:T1554
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4f2fa285-c269-4bbc-afe8-afbd8fcfcda9
Mandiant Cutting Edge Part 2 January 2024 · Mandiant Cutting Edge January 2024 · Volexity Ivanti Zero-Day Exploitation January 2024ATTACK:enterprise:C0029 → uses → ATTACK:enterprise:T1021.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--510b9143-95fb-482b-8680-751317550260
Volexity Ivanti Zero-Day Exploitation January 2024ATTACK:enterprise:C0029 → uses → ATTACK:enterprise:T1095
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--568964d5-6205-4d46-9d14-2914ba349afd
Mandiant Cutting Edge Part 3 February 2024ATTACK:enterprise:C0029 → uses → ATTACK:enterprise:T1594
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--57637c68-0d94-427a-a803-4f1900ccefac
Volexity Ivanti Zero-Day Exploitation January 2024ATTACK:enterprise:C0029 → uses → ATTACK:enterprise:S1123
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5d628e12-47dc-4457-9dbd-a2a86dcdfca0
Mandiant Cutting Edge Part 3 February 2024ATTACK:enterprise:C0029 → uses → ATTACK:enterprise:T1505.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--63534b4f-e8aa-4824-99ce-0daf9d765b9d
Mandiant Cutting Edge January 2024 · Volexity Ivanti Zero-Day Exploitation January 2024ATTACK:enterprise:C0029 → uses → ATTACK:enterprise:S0488
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7d59a08b-6bef-4fe2-a5ac-ffff0680223e
Mandiant Cutting Edge Part 2 January 2024ATTACK:enterprise:C0029 → uses → ATTACK:enterprise:S1115
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7d6cd19c-de8a-45ab-a54a-213bef87dee6
Mandiant Cutting Edge January 2024ATTACK:enterprise:C0029 → uses → ATTACK:enterprise:S1114
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8217db4e-1bd7-4316-8c9d-cd52b6e36dbe
Mandiant Cutting Edge January 2024ATTACK:enterprise:C0029 → uses → ATTACK:enterprise:S1118
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8a5fa1e9-835e-4897-bb67-ca6764dafac3
Mandiant Cutting Edge Part 3 February 2024 · Mandiant Cutting Edge Part 2 January 2024ATTACK:enterprise:C0029 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8c6af9f3-6301-4d49-afff-1fda7db57e3a
Volexity Ivanti Zero-Day Exploitation January 2024ATTACK:enterprise:C0029 → uses → ATTACK:enterprise:T1003.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--94175b7b-a332-4e38-9d7b-3b900825bb3a
Volexity Ivanti Zero-Day Exploitation January 2024ATTACK:enterprise:C0029 → uses → ATTACK:enterprise:T1572
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9978b502-d1c2-4673-8df5-878f3184fe4e
Mandiant Cutting Edge Part 2 January 2024ATTACK:enterprise:C0029 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9cf09dbc-7668-4c1c-8e57-01f9c082c80d
Volexity Ivanti Global Exploitation January 2024 · Mandiant Cutting Edge Part 3 February 2024 · Mandiant Cutting Edge Part 2 January 2024 · Mandiant Cutting Edge January 2024 · Volexity Ivanti Zero-Day Exploitation January 2024ATTACK:enterprise:C0029 → uses → ATTACK:enterprise:T1560.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9fdf1013-db2c-4aba-a723-e21ff9c18bee
Mandiant Cutting Edge Part 2 January 2024ATTACK:enterprise:C0029 → uses → ATTACK:enterprise:T1059.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a5bcc6f7-27af-4335-bf02-59fe5d0cd62e
Mandiant Cutting Edge Part 3 February 2024 · Volexity Ivanti Zero-Day Exploitation January 2024ATTACK:enterprise:C0029 → uses → ATTACK:enterprise:T1584.008
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b1ce8372-ecac-40c4-9b92-a6073cacec31
Volexity Ivanti Global Exploitation January 2024 · Mandiant Cutting Edge January 2024ATTACK:enterprise:C0029 → uses → ATTACK:enterprise:T1005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b49fbcf8-ccc9-442b-a0d5-0bb595691775
Mandiant Cutting Edge Part 2 January 2024 · Volexity Ivanti Zero-Day Exploitation January 2024ATTACK:enterprise:C0029 → uses → ATTACK:enterprise:T1021.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b5f6b196-576d-4f4e-be05-1923cbbd21a0
Volexity Ivanti Zero-Day Exploitation January 2024ATTACK:enterprise:C0029 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c2057ba9-0072-46aa-acce-f9277c4e38bd
Mandiant Cutting Edge Part 2 January 2024ATTACK:enterprise:C0029 → uses → ATTACK:enterprise:S1120
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c8e219f3-279d-4953-ae1c-f0bfd4a33bed
Mandiant Cutting Edge Part 2 January 2024ATTACK:enterprise:C0029 → uses → ATTACK:enterprise:T1056.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d2881846-1061-4f1e-a9bf-4dfc6a7e4b41
Volexity Ivanti Zero-Day Exploitation January 2024ATTACK:enterprise:C0029 → uses → ATTACK:enterprise:T1078.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d45c5aa0-8f47-4ccc-b78f-48391d41ecc6
Volexity Ivanti Zero-Day Exploitation January 2024ATTACK:enterprise:C0029 → uses → ATTACK:enterprise:T1056.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--de045bf6-5f26-485b-ab6d-74552b0cded9
Volexity Ivanti Zero-Day Exploitation January 2024ATTACK:enterprise:C0029 → uses → ATTACK:enterprise:T1027.013
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--df5db6d7-a072-4d04-a638-843ac66234ef
Mandiant Cutting Edge Part 2 January 2024ATTACK:enterprise:C0029 → uses → ATTACK:enterprise:S0357
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f2d2ca45-02eb-4afb-a084-82f9823088b8
Mandiant Cutting Edge Part 2 January 2024ATTACK:enterprise:C0029 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f2f3bc50-78d0-490f-a91a-c0df35f68891
Mandiant Cutting Edge Part 3 February 2024 · Mandiant Cutting Edge January 2024ATTACK:enterprise:C0029 → uses → ATTACK:enterprise:S1117
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fa68575d-4ffa-4532-a973-3506540e5c2e
Volexity Ivanti Zero-Day Exploitation January 2024ATTACK:enterprise:C0029 → uses → ATTACK:enterprise:S1119
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fa755fbd-3f98-4795-ba15-d1f80983b4d6
Mandiant Cutting Edge Part 2 January 2024