PULSEJUMP
PULSEJUMP is a Perl-based information and credential harvesting script used in compromises of Pulse Secure (Pulse Connect Secure) VPN appliances. Mandiant/FireEye reported it as malware used by UNC2717, which targeted global government agencies between October 2020 and March 2021; in March 2021, UNC2717 was observed using RADIALPULSE, PULSEJUMP, and HARDPULSE at a European organization. The malware is described as harvesting system information and credentials and writing collected results to /tmp/dsactiveuser.statementcounters. A reported sample has SHA256 7fa71a7f76ef63465cfeacf58217e0b66fc71bc81d37c44380a6f572b8a3ec7a. The broader intrusion activity involved exploitation of Pulse Secure vulnerabilities, including CVE-2021-22893 and previously disclosed flaws, to compromise VPN appliances, bypass authentication controls, and maintain access. High-confidence indicators directly associated with PULSEJUMP in the content are its Perl implementation, the output path /tmp/dsactiveuser.statementcounters, its use by UNC2717, and the cited SHA256 hash.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
4 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
"...newly discovered critical zero-day authentication bypass vulnerability (CVE-2021-22893) that is currently being exploited in the wild and for which there is no patch available yet." ... "Ivanti ... has released temporary mitigations to address the arbitrary file execution vulnerability (CVE-2021-22893, CVSS score: 10)"
"UNC2717 - HARDPULSE, QUIETPULSE, AND PULSEJUMP"
"UNC2717 - HARDPULSE, QUIETPULSE, AND PULSEJUMP"
"UNC2717 - HARDPULSE, QUIETPULSE, AND PULSEJUMP"
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Techniques & procedures
5 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 technique"...zero-day authentication bypass vulnerability in the Pulse Connect Secure (PCS) SSL VPN appliance actively exploited... vulnerability tracked as CVE-2021-22893... exploited in the wild... to hack the networks... and execute arbitrary code remotely on Pulse Connect Secure gateways."
Persistence
2 techniques"They modified scripts on the Pulse Secure system which enabled the malware to survive software updates and factory resets."
Privilege Escalation
1 techniqueDefense Impairment
1 techniqueCredential Access
2 techniques"They developed malware that enabled them to harvest Active Directory credentials..."
Collection
1 technique"PULSEJUMP... system information and credential harvesting... writes information... to /tmp/dsactiveuser.statementcounters"; multiple tools write stolen creds/output to /tmp/*.statementcounters or other local paths.
IOCs tracked for this family
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Custom malware family associated with exploitation of Pulse Secure VPN appliances during intrusions attributed to UNC2717.
Malware used by UNC2717 in PCS gateway intrusions to maintain access and support credential theft/bypass of MFA on Pulse Secure devices.
Perl script that harvests system/auth configuration information (e.g., auth servers, roles) and writes collected data to /tmp/dsactiveuser.statementcounters; also referenced alongside credential-recording artifacts in the report.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.