Loading malware…
QUIETPULSE is a persistence-focused malware component used in compromises of Pulse Connect Secure VPN appliances. It has been associated with UNC2717, a cluster observed targeting global government agencies between late 2020 and early 2021 during broader exploitation of Pulse Secure vulnerabilities including CVE-2021-22893 and previously disclosed flaws. QUIETPULSE operates by modifying a legitimate Perl component so that it forks and executes a helper script, enabling attacker-controlled logic to run from within normal appliance processes.
Its helper component is designed to maintain persistence by repeatedly restoring malicious files during upgrade activity and by altering integrity-checking behavior, helping the intrusion survive remediation attempts and software updates. This places QUIETPULSE within the set of Pulse Secure appliance implants used to preserve long-term access on edge infrastructure after initial compromise. The malware is part of a wider intrusion ecosystem that included webshells, credential-harvesting tools, authentication-bypass implants, and log-wiping utilities deployed against government and other high-value organizations.
4 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
9 distinct techniques documented for this family, organized by ATT&CK tactic.
CVE-2020-8243 (CVSS: 7.2) ... An unauthenticated threat actor could upload a customer template to perform arbitrary code execution. ... CVE-2020-8260 (CVSS: 7.2) ... an unauthenticated threat could execute arbitrary code due to a vulnerability in the admin web interface.
The main purpose of these malware tools was to circumvent authentication and to gain backdoor access.
"QUIETPULSE... modified... to fork the child process /home/bin/dshelper"; dshelper loop re-inserts webshell code and ensures dsserver/dshelper persist in /tmp/data across upgrades.
"They modified scripts on the Pulse Secure system which enabled the malware to survive software updates and factory resets."
These attacks include bypassing both single and multi-factor authentication on the appliances and deployment of webshells for maintaining access.
These attacks include using known vulnerabilities from 2019 and 2020 (CVE-2019-11510, CVE-2020-8243, and CVE-2020-8260) and a previously unknown authentication bypass vulnerability tracked as CVE-2021-22893.
"QUIETPULSE... modified... to fork the child process /home/bin/dshelper"; dshelper loop re-inserts webshell code and ensures dsserver/dshelper persist in /tmp/data across upgrades.
"They modified scripts on the Pulse Secure system which enabled the malware to survive software updates and factory resets."
These attacks include bypassing both single and multi-factor authentication on the appliances and deployment of webshells for maintaining access.
"LOCKPICK Patcher... running sed on the integrity checker... insert an early exit routine... causes this script to exit without performing its intended checks"; QUIETPULSE check 4 changes check_integrity.sh from exit 1 to exit 0.
"They developed malware that enabled them to harvest Active Directory credentials..."
These attacks include bypassing both single and multi-factor authentication on the appliances and deployment of webshells for maintaining access.
CVE-2021-22893 – Pulse Connect Secure RCE Vulnerability (CVSS: 10.0) ... Using unspecified vectors, a remote unauthenticated threat actor could execute arbitrary code.
2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.