Loading malware…
HARDPULSE is a webshell used in compromises of Pulse Secure (Pulse Connect Secure) VPN appliances. It is identified as compcheckjava.cgi, with reported SHA256 1d3ab04e21cfd40aa8d4300a359a09e3b520d39b1496be1e4bc91ae1f6730ecc. Mandiant/FireEye associated HARDPULSE with UNC2717, which targeted global government agencies between October 2020 and March 2021; reporting also notes UNC2717 activity at a European organization in March 2021. The broader intrusion set targeted government, defense, and financial organizations and involved exploitation of Pulse Secure vulnerabilities including CVE-2021-22893, alongside older flaws such as CVE-2019-11510, CVE-2020-8243, and CVE-2020-8260.
HARDPULSE supports arbitrary file read and write operations and may execute arbitrary commands via DSSafe::psystem, depending on implementation. It responds to HTTP GET and PUT requests. Reported functionality includes a ReadFile command that accepts a base64-encoded, RC4-encrypted filename via the img parameter and returns file contents base64-encoded and RC4-encrypted with Content-Type application/x-download and a Content-Disposition attachment filename of tmp. A WriteFile command accepts a base64-encoded, RC4-encrypted filename via the cert parameter and base64-encoded, RC4-encrypted file data via the md5 parameter and writes the data to disk. An Execute command accepts base64-encoded, RC4-encrypted commands via the name parameter, blocks the cd command by returning Error 404, redirects command output to /tmp/1 using ">/tmp/1 2>&1", and returns the output base64-encoded and RC4-encrypted while masquerading the response as Content-Type image/gif.
Its command-and-control/data handling uses base64 plus RC4. The first six characters of transmitted data are used as a random per-request nonce, which is combined with a static RC4 phrase to form the RC4 key; the static phrase is not sent over the wire. HARDPULSE also contains an embedded recovery URL of the form https://ive-host/dana-na/auth/recover.cgi?token=<varies>. Additional reporting states attacker interaction used parameters including checkcode, hashid, m, and filename.
Within the Pulse Secure exploitation ecosystem, HARDPULSE was deployed alongside QUIETPULSE and PULSEJUMP by UNC2717. High-confidence indicators directly mentioned in the content include the filename/path compcheckjava.cgi, the embedded recover.cgi tokenized URL path, use of HTTP GET/PUT, parameters img, cert, md5, and name for file and command operations, and temporary output redirection to /tmp/1.
4 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
7 distinct techniques documented for this family, organized by ATT&CK tactic.
"...zero-day authentication bypass vulnerability in the Pulse Connect Secure (PCS) SSL VPN appliance actively exploited... vulnerability tracked as CVE-2021-22893... exploited in the wild... to hack the networks... and execute arbitrary code remotely on Pulse Connect Secure gateways."
"Execute... commands... executed via the system API with output piped to the file /tmp/1"; "compcheckresult.cgi... executes it verbatim... using the system API"; "webshell will execute the passed command on the victim host's command line".
"They modified scripts on the Pulse Secure system which enabled the malware to survive software updates and factory resets."
"...harvest Active Directory credentials and bypass multifactor authentication on Pulse Secure devices to access victim networks."
"They modified scripts on the Pulse Secure system which enabled the malware to survive software updates and factory resets."
"...harvest Active Directory credentials and bypass multifactor authentication on Pulse Secure devices to access victim networks."
"They developed malware that enabled them to harvest Active Directory credentials..."
"...harvest Active Directory credentials and bypass multifactor authentication on Pulse Secure devices to access victim networks."
Multiple modified Pulse Secure CGI/Perl scripts act as webshells (e.g., licenseserverproto.cgi, secid_canceltoken.cgi, compcheckresult.cgi) that parse HTTP parameters/headers and execute attacker-supplied commands, returning output in HTTP responses (sometimes masquerading as GIF/text/html).
"ReadFile... opens it for read... sent back..."; "WriteFile... filename... file data... written"; "HARDPULSE... matched against get and put which will read/write arbitrary files".
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.