THINBLOOD
THINBLOOD is a log-wiping utility used on compromised Pulse Secure (Pulse Connect Secure) SSL VPN appliances. It is associated with UNC2630 and has been linked in reporting to APT5/China-nexus activity. Mandiant/FireEye reported UNC2630 using THINBLOOD against U.S. Defense Industrial Base targets from at least August 2020 through March 2021 as part of broader exploitation of Pulse Secure appliances, including activity involving CVE-2021-22893 and older Pulse Secure vulnerabilities. THINBLOOD was used to clear SSL VPN log files under /home/runtime/logs. Specifically, the utility identified as dsclslog (SHA256: 88170125598a4fb801102ad56494a773895059ac8550a983fdd2ef429653f079) removes entries matching actor-supplied regular expressions from /home/runtime/logs/log.events.vc0 or /home/runtime/logs/log.access.vc0, using temporary copies followed by mv/rm operations. Its primary purpose is defense evasion and anti-forensics by deleting evidence of attacker activity from appliance logs. THINBLOOD is documented alongside other Pulse Secure malware families and utilities including SLOWPULSE, RADIALPULSE, ATRIUM, PACEMAKER, SLIGHTPULSE, and PULSECHECK.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
4 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
"...newly discovered critical zero-day authentication bypass vulnerability (CVE-2021-22893) that is currently being exploited in the wild and for which there is no patch available yet." ... "Ivanti ... has released temporary mitigations to address the arbitrary file execution vulnerability (CVE-2021-22893, CVSS score: 10)"
"UNC2630 - SLOWPULSE, RADIALPULSE, THINBLOOD, ATRIUM, PACEMAKER, SLIGHTPULSE, and PULSECHECK"
"UNC2630 - SLOWPULSE, RADIALPULSE, THINBLOOD, ATRIUM, PACEMAKER, SLIGHTPULSE, and PULSECHECK"
UNC2630 targeted U.S. DIB companies with SLOWPULSE, RADIALPULSE, THINBLOOD, ATRIUM, PACEMAKER, SLIGHTPULSE, and PULSECHECK as early as August 2020 until March 2021.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
APT5 has used the THINBLOOD utility to clear SSL VPN log files located at /home/runtime/logs.
Techniques & procedures
6 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 technique"...zero-day authentication bypass vulnerability in the Pulse Connect Secure (PCS) SSL VPN appliance actively exploited... vulnerability tracked as CVE-2021-22893... exploited in the wild... to hack the networks... and execute arbitrary code remotely on Pulse Connect Secure gateways."
Persistence
2 techniques"They modified scripts on the Pulse Secure system which enabled the malware to survive software updates and factory resets."
Privilege Escalation
1 techniqueStealth
2 techniquesAPT5 has used the THINBLOOD utility to clear SSL VPN log files located at /home/runtime/logs.
"THINBLOOD... log wiper utility... modify... log.events.vc0 or log.access.vc0... overwrite the original log with the cleaned version"; "clear_log.sh... zeroing log lines that match a given regex".
Defense Impairment
1 techniqueCredential Access
2 techniques"They developed malware that enabled them to harvest Active Directory credentials..."
IOCs tracked for this family
2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Utility used to remove indicators by clearing SSL VPN log files.
Custom malware family associated with exploitation of Pulse Secure VPN appliances during intrusions attributed to UNC2630.
Malware used by UNC2630 in attacks leveraging Pulse Secure vulnerabilities to maintain long-term access and facilitate credential/data theft.
Log-wiping utility used to remove evidence from Pulse Secure appliance logs by deleting/zeroing entries matching attacker-supplied regex patterns (compiled dsclslog variant and a sed-based shell script variant).
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.