Loading malware…
PULSEJUMP is a Perl-based post-compromise utility used in intrusions involving Pulse Connect Secure VPN appliances. It is associated with exploitation activity against Pulse Secure devices, including campaigns tied to the UNC2717 cluster that targeted government organizations between late 2020 and early 2021. The malware is designed to harvest system information and credentials from compromised appliances, supporting follow-on access and intelligence collection.
PULSEJUMP operates on Pulse Secure appliances running a Linux-based environment and writes harvested results locally for later retrieval by the operator. Its observed role within broader intrusion sets was credential and system-information collection after attackers had already obtained access to the appliance through exploitation of Pulse Secure vulnerabilities and deployment of additional tooling. In the same campaigns, operators also used webshells, persistence mechanisms, and authentication-bypass implants to maintain long-term access and evade remediation.
PULSEJUMP has been observed alongside other Pulse Secure-focused malware families such as HARDPULSE and QUIETPULSE. Its use forms part of a broader tradecraft pattern in which attackers compromised edge VPN infrastructure, harvested credentials, bypassed multifactor authentication, and maintained durable access to victim environments. High-confidence reporting links PULSEJUMP to operations against global government targets, but available information does not support a more specific malware classification than credential-harvesting utility.
4 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
8 distinct techniques documented for this family, organized by ATT&CK tactic.
CVE-2020-8243 (CVSS: 7.2) ... An unauthenticated threat actor could upload a customer template to perform arbitrary code execution. ... CVE-2020-8260 (CVSS: 7.2) ... an unauthenticated threat could execute arbitrary code due to a vulnerability in the admin web interface.
The main purpose of these malware tools was to circumvent authentication and to gain backdoor access.
"They modified scripts on the Pulse Secure system which enabled the malware to survive software updates and factory resets."
These attacks include bypassing both single and multi-factor authentication on the appliances and deployment of webshells for maintaining access.
These attacks include using known vulnerabilities from 2019 and 2020 (CVE-2019-11510, CVE-2020-8243, and CVE-2020-8260) and a previously unknown authentication bypass vulnerability tracked as CVE-2021-22893.
"They modified scripts on the Pulse Secure system which enabled the malware to survive software updates and factory resets."
These attacks include bypassing both single and multi-factor authentication on the appliances and deployment of webshells for maintaining access.
"They developed malware that enabled them to harvest Active Directory credentials..."
These attacks include bypassing both single and multi-factor authentication on the appliances and deployment of webshells for maintaining access.
CVE-2021-22893 – Pulse Connect Secure RCE Vulnerability (CVSS: 10.0) ... Using unspecified vectors, a remote unauthenticated threat actor could execute arbitrary code.
"PULSEJUMP... system information and credential harvesting... writes information... to /tmp/dsactiveuser.statementcounters"; multiple tools write stolen creds/output to /tmp/*.statementcounters or other local paths.
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.