Loading malware…
SLIGHTPULSE is a web shell used in compromises of Pulse Connect Secure VPN appliances. It is associated with intrusion activity tracked as UNC2630, a cluster assessed in industry reporting as likely aligned with Chinese espionage objectives and potentially linked to APT5. The malware was observed in campaigns targeting organizations including U.S. Defense Industrial Base entities during the 2020–2021 Pulse Secure intrusion wave.
SLIGHTPULSE provides post-exploitation access on compromised servers by enabling attackers to read, write, and execute files, and to run arbitrary commands on the appliance. It records command execution output locally and supports Base64 encoding of inbound and outbound command-and-control traffic, indicating an effort to obfuscate operator communications and results. As a server-side implant on internet-facing VPN infrastructure, it functions as a durable access mechanism for remote administration, follow-on credential theft, and broader intrusion operations.
Within the broader Pulse Secure malware ecosystem, SLIGHTPULSE appeared alongside other appliance-focused implants and utilities used for credential harvesting, authentication bypass, persistence across upgrades, and log tampering. Its role is best characterized as a web-accessible command execution backdoor deployed after exploitation of Pulse Secure vulnerabilities, including activity contemporaneous with exploitation of CVE-2021-22893 and older Pulse Secure flaws. It targets Linux-based Pulse Connect Secure appliances rather than general-purpose desktop systems.
4 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
2 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
"UNC2630 - SLOWPULSE, RADIALPULSE, THINBLOOD, ATRIUM, PACEMAKER, SLIGHTPULSE, and PULSECHECK"
18 distinct techniques documented for this family, organized by ATT&CK tactic.
CVE-2020-8243 (CVSS: 7.2) ... An unauthenticated threat actor could upload a customer template to perform arbitrary code execution. ... CVE-2020-8260 (CVSS: 7.2) ... an unauthenticated threat could execute arbitrary code due to a vulnerability in the admin web interface.
The main purpose of these malware tools was to circumvent authentication and to gain backdoor access.
Dragonfly has used the command line for execution. Empire uses a command-line interface to interact with systems. StarProxy has used the command line for execution of commands.
"They modified scripts on the Pulse Secure system which enabled the malware to survive software updates and factory resets."
These attacks include bypassing both single and multi-factor authentication on the appliances and deployment of webshells for maintaining access.
These attacks include using known vulnerabilities from 2019 and 2020 (CVE-2019-11510, CVE-2020-8243, and CVE-2020-8260) and a previously unknown authentication bypass vulnerability tracked as CVE-2021-22893.
"They modified scripts on the Pulse Secure system which enabled the malware to survive software updates and factory resets."
The content repeatedly describes malware and threat actors decoding, decrypting, deobfuscating, or unpacking payloads, strings, configuration data, commands, and C2 responses prior to execution or use.
These attacks include bypassing both single and multi-factor authentication on the appliances and deployment of webshells for maintaining access.
"They developed malware that enabled them to harvest Active Directory credentials..."
These attacks include bypassing both single and multi-factor authentication on the appliances and deployment of webshells for maintaining access.
CVE-2021-22893 – Pulse Connect Secure RCE Vulnerability (CVSS: 10.0) ... Using unspecified vectors, a remote unauthenticated threat actor could execute arbitrary code.
The content repeatedly describes threat actors and malware collecting, stealing, identifying, copying, or staging files, documents, credentials, logs, databases, and other information from compromised hosts or local systems.
The content repeatedly describes adversaries and malware storing collected data, command output, credentials, archives, or files in local temporary folders, working directories, hidden directories, registry locations, recycle bins, or specific files prior to exfiltration.
The content repeatedly describes threat actors and malware using HTTP and HTTPS for command and control, such as: "Sandworm Team used BlackEnergy to communicate between compromised hosts and their command-and-control servers via HTTP post requests."
"ReadFile... opens it for read... sent back..."; "WriteFile... filename... file data... written"; "HARDPULSE... matched against get and put which will read/write arbitrary files".
C2 traffic from ADVSTORESHELL is encrypted, then encoded with Base64 encoding... APT19 HTTP malware variant used Base64 to encode communications to the C2 server... APT33 has used base64 to encode command and control traffic.
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.