JumbledPath
- ID
- S1206
- Type
- Malware
- Platforms
- Network Devices
- Source
- attack.mitre.org
- MITRE last modified
- 16 Apr 2025
JumbledPath is a custom-built utility written in GO that has been used by Salt Typhoon since at least 2024 for packet capture on remote Cisco devices. JumbledPath is compiled as an ELF binary using x86-64 architecture which makes it potentially useable across Linux operating systems and network devices from multiple vendors.[1]
Techniques used (6)
- T1040 Network Sniffing
- T1104 Multi-Stage Channels
- T1560 Archive Collected Data
- T1665 Hide Infrastructure
- T1685 Disable or Modify Tools
- T1685.006 Clear Linux or Mac System Logs