GLASSTOKEN
- ID
- S1117
- Type
- Malware
- Platforms
- Network Devices
- Source
- attack.mitre.org
- MITRE last modified
- 16 Apr 2025
GLASSTOKEN is a custom web shell used by threat actors during Cutting Edge to execute commands on compromised Ivanti Secure Connect VPNs.[1]
Techniques used (4)
- T1059.001 PowerShell
- T1132.001 Standard Encoding
- T1140 Deobfuscate/Decode Files or Information
- T1505.003 Web Shell