UNC5221: Unreported and Undetected WIREFIRE Web Shell Variant

Our investigation uncovers a previously unreported and undetected variant of the WIREFIRE web shell, a Python-based implant found in Ivanti Connect Secure (ICS) VPN compromised appliances.