Loading malware…
CLEANPULSE is a Pulse Secure-focused memory patching utility associated with APT5 and with suspected Chinese espionage activity tracked by Mandiant in compromises of Pulse Secure VPN appliances. It is described as a utility that may be used to prevent certain log events from occurring, and as a process-injection or memory-patching tool used to insert command-line strings into a targeted process to alter its functionality. Reporting states APT5 used CLEANPULSE to prevent certain log events from occurring, supporting defense evasion and log tampering on compromised systems. Mandiant identified CLEANPULSE as one of multiple malware families exclusively designed to infect Pulse Secure VPN appliances, and noted it was found near an ATRIUM web shell during investigations into intrusions affecting sectors including defense, government, high tech, transportation, and financial organizations in the U.S. and Europe. High-confidence behavior directly described in the content is limited to memory patching, process manipulation, and suppression of logging-related events; no specific standalone IOCs are provided in the source content.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
"CLEANPULSE is a memory patching utility that may be used to prevent certain log events from occurring."
2 distinct techniques documented for this family, organized by ATT&CK tactic.
"Sandworm Team loaded BlackEnergy into svchost.exe, which then launched iexplore.exe for their C2." / "VEILEDSIGNAL uses process injection to inject the C2 communication module code..." / "...inject shellcode into svchost.exe" / "...VirtualAlloc, WriteProcessMemory, and then CreateRemoteThread..."
"Sandworm Team loaded BlackEnergy into svchost.exe, which then launched iexplore.exe for their C2." / "VEILEDSIGNAL uses process injection to inject the C2 communication module code..." / "...inject shellcode into svchost.exe" / "...VirtualAlloc, WriteProcessMemory, and then CreateRemoteThread..."
APT5 has used the CLEANPULSE utility to insert command line strings into a targeted process to prevent certain log events from occurring.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.