Loading threat actor…
UNC2717 is a cyberespionage activity cluster tracked by Mandiant that compromised government agencies worldwide, including organizations in the United States and Europe, between October 2020 and March 2021. Its operations exploited vulnerabilities in Pulse Connect Secure VPN appliances to establish access and deploy custom appliance malware and webshells. Associated malware families include HARDPULSE, QUIETPULSE, and PULSEJUMP; RADIALPULSE was also observed during a March 2021 intrusion at a European organization. UNC2717 employed advanced concealment techniques, including timestamp manipulation and deletion or modification of logs, web server core dumps, and staged exfiltration files. Its operations included credential harvesting, authentication bypass, and persistent access through modifications to appliance software, with persistence mechanisms capable of surviving software updates and factory resets. UNC2717 is tracked separately from UNC2630, and its government sponsorship or affiliation with an established APT group has not been conclusively established.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
6 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
7 malware families Mallory has associated with this actor across public reporting.
2 additional families tracked in Mallory.
2 CVEs Mallory has associated with this actor across public reporting. 2 of them are exploited in the wild (not necessarily by this actor).
7 indicators attributed to this actor. Values are masked here and available in full in Mallory.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.