Loading malware…
ATRIUM is a webshell used in intrusions involving Pulse Secure Connect Secure VPN appliances. It is associated with exploitation activity tracked under UNC2630 and has been linked by multiple investigations to China-nexus espionage operations, including activity overlapping with APT5. ATRIUM was deployed against organizations including U.S. Defense Industrial Base entities during campaigns active from at least 2020 into 2021.
ATRIUM is implemented by modifying a legitimate Pulse Secure component to provide attacker-controlled command execution. The implant executes attacker-supplied input received through an HTTP query parameter, enabling post-compromise remote administration on the appliance. It has been used as a persistence mechanism on compromised VPN gateways, including through modification of legitimate upgrade-related scripts so the webshell can survive software upgrades and reappear after remediation attempts focused only on active filesystems.
Operationally, ATRIUM formed part of a broader Pulse Secure malware ecosystem that included credential theft, authentication bypass, log tampering, and upgrade-persistence tooling. In observed campaigns, operators used compromised appliances as footholds for long-term access, credential harvesting, lateral movement into internal environments, and follow-on espionage activity. Targeting spanned government, defense, financial, and other sectors in the U.S. and Europe. ATRIUM is notable as one of several Pulse-specific webshells used to maintain covert access on network edge infrastructure while blending into legitimate appliance components.
4 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
2 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
APT5 has modified legitimate binaries and scripts for Pulse Secure VPNs including the legitimate DSUpgrade.pm file to install the ATRIUM webshell for persistence.
11 distinct techniques documented for this family, organized by ATT&CK tactic.
CVE-2020-8243 (CVSS: 7.2) ... An unauthenticated threat actor could upload a customer template to perform arbitrary code execution. ... CVE-2020-8260 (CVSS: 7.2) ... an unauthenticated threat could execute arbitrary code due to a vulnerability in the admin web interface.
The main purpose of these malware tools was to circumvent authentication and to gain backdoor access.
"Execute... commands... executed via the system API with output piped to the file /tmp/1"; "compcheckresult.cgi... executes it verbatim... using the system API"; "webshell will execute the passed command on the victim host's command line".
APT5 has modified legitimate binaries and scripts for Pulse Secure VPNs including the legitimate DSUpgrade.pm file to install the ATRIUM webshell for persistence.
"They modified scripts on the Pulse Secure system which enabled the malware to survive software updates and factory resets."
APT5 has modified legitimate binaries and scripts for Pulse Secure VPNs including the legitimate DSUpgrade.pm file to install the ATRIUM webshell for persistence.
These attacks include bypassing both single and multi-factor authentication on the appliances and deployment of webshells for maintaining access.
These attacks include using known vulnerabilities from 2019 and 2020 (CVE-2019-11510, CVE-2020-8243, and CVE-2020-8260) and a previously unknown authentication bypass vulnerability tracked as CVE-2021-22893.
"They modified scripts on the Pulse Secure system which enabled the malware to survive software updates and factory resets."
These attacks include bypassing both single and multi-factor authentication on the appliances and deployment of webshells for maintaining access.
"They developed malware that enabled them to harvest Active Directory credentials..."
These attacks include bypassing both single and multi-factor authentication on the appliances and deployment of webshells for maintaining access.
CVE-2021-22893 – Pulse Connect Secure RCE Vulnerability (CVSS: 10.0) ... Using unspecified vectors, a remote unauthenticated threat actor could execute arbitrary code.
Multiple modified Pulse Secure CGI/Perl scripts act as webshells (e.g., licenseserverproto.cgi, secid_canceltoken.cgi, compcheckresult.cgi) that parse HTTP parameters/headers and execute attacker-supplied commands, returning output in HTTP responses (sometimes masquerading as GIF/text/html).
4 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.