Loading malware…
THINBLOOD is a log-wiping utility used in compromises of Pulse Connect Secure SSL VPN appliances. It has been associated with UNC2630 activity and with APT5-linked intrusion sets targeting organizations including U.S. Defense Industrial Base entities during the broader exploitation of Pulse Secure vulnerabilities, including campaigns tied to CVE-2021-22893 and earlier Pulse Secure flaws. THINBLOOD is part of a larger ecosystem of Pulse Secure-focused tooling that included authentication-bypass implants, credential theft utilities, web shells, and persistence mechanisms designed to survive upgrades and maintain long-term access.
Its primary function is defense evasion through anti-forensics. THINBLOOD clears relevant SSL VPN log data by removing entries that match attacker-supplied regular expressions from appliance log files under the runtime logging area. Reported behavior indicates it edits targeted access and event logs via temporary copies and file replacement operations, allowing operators to selectively erase traces of malicious authentication activity, web shell use, or other appliance interactions while preserving the surrounding log structure. This selective log tampering supports prolonged covert access and complicates incident response and forensic reconstruction.
THINBLOOD runs on Linux-based Pulse Connect Secure appliances and is best characterized as a specialized utility rather than a full-featured implant. It is typically observed post-compromise after initial access has already been established through exploitation of public-facing VPN infrastructure. In the campaigns where it appeared, operators also used credential harvesting, multifactor-authentication bypass, persistence through modified legitimate binaries and scripts, and lateral movement using stolen credentials. THINBLOOD’s role within these intrusions is to reduce visibility of those operations by removing evidence from appliance logs.
4 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
APT5 has used the THINBLOOD utility to clear SSL VPN log files located at /home/runtime/logs.
9 distinct techniques documented for this family, organized by ATT&CK tactic.
CVE-2020-8243 (CVSS: 7.2) ... An unauthenticated threat actor could upload a customer template to perform arbitrary code execution. ... CVE-2020-8260 (CVSS: 7.2) ... an unauthenticated threat could execute arbitrary code due to a vulnerability in the admin web interface.
The main purpose of these malware tools was to circumvent authentication and to gain backdoor access.
"They modified scripts on the Pulse Secure system which enabled the malware to survive software updates and factory resets."
These attacks include bypassing both single and multi-factor authentication on the appliances and deployment of webshells for maintaining access.
These attacks include using known vulnerabilities from 2019 and 2020 (CVE-2019-11510, CVE-2020-8243, and CVE-2020-8260) and a previously unknown authentication bypass vulnerability tracked as CVE-2021-22893.
"They modified scripts on the Pulse Secure system which enabled the malware to survive software updates and factory resets."
APT5 has used the THINBLOOD utility to clear SSL VPN log files located at /home/runtime/logs.
These attacks include bypassing both single and multi-factor authentication on the appliances and deployment of webshells for maintaining access.
"THINBLOOD... log wiper utility... modify... log.events.vc0 or log.access.vc0... overwrite the original log with the cleaned version"; "clear_log.sh... zeroing log lines that match a given regex".
"They developed malware that enabled them to harvest Active Directory credentials..."
These attacks include bypassing both single and multi-factor authentication on the appliances and deployment of webshells for maintaining access.
CVE-2021-22893 – Pulse Connect Secure RCE Vulnerability (CVSS: 10.0) ... Using unspecified vectors, a remote unauthenticated threat actor could execute arbitrary code.
2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.