MalwareUsed by 2 actorsExploits 4 CVEs

SLIGHTPULSE

SLIGHTPULSE is a web shell used on compromised Pulse Secure VPN appliances. It is associated with UNC2630, which Mandiant/FireEye reported targeting U.S. Defense Industrial Base companies from at least August 2020 through March 2021; reporting also noted suspected ties between UNC2630 and Chinese state-sponsored activity, potentially linked to APT5. SLIGHTPULSE is described as capable of reading, writing, and executing files on compromised servers, and it contains functionality to execute arbitrary commands passed to it. It can base64-encode incoming and outgoing command-and-control messages. Command execution output has been piped to /tmp/1, which serves as a command execution log/staging location. The malware was deployed alongside other Pulse Secure-focused tooling and web shells including SLOWPULSE, RADIALPULSE, THINBLOOD, ATRIUM, PACEMAKER, and PULSECHECK. Detection references in the content include FE_APT_Webshell_PL_SLIGHTPULSE_1 and “Malicious File Transfer - SLIGHTPULSE, Download, Variant #1.”

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

4 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

4 CVES

CVE-2021-22893Authentication Bypass RCE in Pulse Connect SecureExploited in the wild

"...newly discovered critical zero-day authentication bypass vulnerability (CVE-2021-22893) that is currently being exploited in the wild and for which there is no patch available yet." ... "Ivanti ... has released temporary mitigations to address the arbitrary file execution vulnerability (CVE-2021-22893, CVSS score: 10)"

via the hacker newsthehackernews.com

CVE-2020-8243Ivanti Pulse Connect Secure Admin Web Interface Template Upload RCE

UNC2630 targeted U.S. DIB companies with SLOWPULSE, RADIALPULSE, THINBLOOD, ATRIUM, PACEMAKER, SLIGHTPULSE, and PULSECHECK as early as August 2020 until March 2021.

via bleeping computerbleepingcomputer.com

CVE-2020-8260Authenticated RCE in Pulse Connect Secure admin web interface via uncontrolled gzip extraction

"UNC2630 - SLOWPULSE, RADIALPULSE, THINBLOOD, ATRIUM, PACEMAKER, SLIGHTPULSE, and PULSECHECK"

via the hacker newsthehackernews.com

CVE-2019-11510Arbitrary File Read in Pulse Secure Pulse Connect Secure

UNC2630 targeted U.S. DIB companies with SLOWPULSE, RADIALPULSE, THINBLOOD, ATRIUM, PACEMAKER, SLIGHTPULSE, and PULSECHECK as early as August 2020 until March 2021.

via bleeping computerbleepingcomputer.com

THREAT ACTORS

Groups observed using it

2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

APT5

"UNC2630 - SLOWPULSE, RADIALPULSE, THINBLOOD, ATRIUM, PACEMAKER, SLIGHTPULSE, and PULSECHECK"

via the hacker newsthehackernews.com

UNC2717

"...remove webshells like ATRIUM and SLIGHTPULSE."

via fireeyefireeye.com

MITRE ATT&CK

Techniques & procedures

16 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1190Exploit Public-Facing ApplicationEvidence1

"...zero-day authentication bypass vulnerability in the Pulse Connect Secure (PCS) SSL VPN appliance actively exploited... vulnerability tracked as CVE-2021-22893... exploited in the wild... to hack the networks... and execute arbitrary code remotely on Pulse Connect Secure gateways."

Execution

2 techniques

T1059Command and Scripting InterpreterEvidence2

APT19 downloaded and launched code within a SCT file; APT32 used COM scriptlets to download Cobalt Strike beacons; APT37 used Ruby scripts to execute payloads; ArcaneDoor included the adversary executing command line interface (CLI) commands.

T1059.003Windows Command ShellEvidence1

Dragonfly has used the command line for execution. Empire uses a command-line interface to interact with systems. StarProxy has used the command line for execution of commands.

Persistence

3 techniques

T1505.003Web ShellEvidence1

T1546Event Triggered ExecutionEvidence1

"They modified scripts on the Pulse Secure system which enabled the malware to survive software updates and factory resets."

T1556Modify Authentication ProcessEvidence1

"...harvest Active Directory credentials and bypass multifactor authentication on Pulse Secure devices to access victim networks."

Privilege Escalation

1 technique

T1546Event Triggered ExecutionEvidence1

"They modified scripts on the Pulse Secure system which enabled the malware to survive software updates and factory resets."

Stealth

1 technique

T1140Deobfuscate/Decode Files or InformationEvidence4

The content repeatedly describes malware and threat actors decoding, decrypting, deobfuscating, or unpacking payloads, strings, configuration data, commands, and C2 responses prior to execution or use.

Defense Impairment

1 technique

T1556Modify Authentication ProcessEvidence1

"...harvest Active Directory credentials and bypass multifactor authentication on Pulse Secure devices to access victim networks."

Credential Access

2 techniques

T1003OS Credential DumpingEvidence1

"They developed malware that enabled them to harvest Active Directory credentials..."

T1556Modify Authentication ProcessEvidence1

"...harvest Active Directory credentials and bypass multifactor authentication on Pulse Secure devices to access victim networks."

Collection

3 techniques

T1005Data from Local SystemEvidence3

The content repeatedly describes threat actors and malware collecting, stealing, identifying, copying, or staging files, documents, credentials, logs, databases, and other information from compromised hosts or local systems.

T1074Data StagedEvidence1

The content repeatedly describes adversaries and malware storing collected data, command output, credentials, archives, or files in local temporary folders, working directories, hidden directories, registry locations, recycle bins, or specific files prior to exfiltration.

T1074.001Local Data StagingEvidence1

Command and Control

5 techniques

T1071.001Web ProtocolsEvidence4

The content repeatedly describes threat actors and malware using HTTP and HTTPS for command and control, such as: "Sandworm Team used BlackEnergy to communicate between compromised hosts and their command-and-control servers via HTTP post requests."

T1105Ingress Tool TransferEvidence2

"ReadFile... opens it for read... sent back..."; "WriteFile... filename... file data... written"; "HARDPULSE... matched against get and put which will read/write arbitrary files".

T1132Data EncodingEvidence2

C2 traffic from ADVSTORESHELL is encrypted, then encoded with Base64 encoding... APT19 HTTP malware variant used Base64 to encode communications to the C2 server... APT33 has used base64 to encode command and control traffic.

T1132.001Standard EncodingEvidence1

T1573.001Symmetric CryptographyEvidence1

INDICATORS OF COMPROMISE

IOCs tracked for this family

1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Hashes

1 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha256●●●●●●●●●●●●View more in app5 years ago

ACTIVITY FEED

Recent activity

14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

14 SOURCESView more in app

fireeyeNews

May 27, 2021

Re-Checking Your Pulse: Updates on Chinese APT Actors Compromising Pulse Secure VPN Devices

Pulse Secure appliance webshell used to maintain access; additionally referenced as being hidden from integrity checks by actor persistence logic.

the hacker newsNews

Apr 21, 2021

WARNING: Hackers Exploit Unpatched Pulse Secure 0-Day to Breach Organizations

Custom malware family associated with exploitation of Pulse Secure VPN appliances during intrusions attributed to UNC2630.

bleeping computerNews

Apr 20, 2021

Pulse Secure VPN zero-day used to hack defense firms, govt orgs

Malware used by UNC2630 in PCS intrusions; associated tradecraft includes persistence across updates/resets and credential harvesting.

fireeyeNews

Apr 20, 2021

Check Your Pulse: Suspected APT Actors Leverage Authentication Bypass Techniques and Pulse Secure Zero-Day

Webshell embedded into meeting_testjs.cgi supporting arbitrary file read/write and command execution; uses base64 + RC4 for request/response data and writes command output to /tmp/1.

+9 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching1

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution2

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities4

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping16

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

SLIGHTPULSE