Mandiant Pulse Secure Zero-Day April 2021

PACEMAKER has the ability to extract credentials from OS memory.

SLIGHTPULSE can read files specified on the local system.

SLOWPULSE can hide malicious code in the padding regions between legitimate functions in the Pulse Secure `libdsplibs.so` file.

PACEMAKER can use PTRACE to attach to a targeted process to read process memory.

SLIGHTPULSE contains functionality to execute arbitrary commands passed to it.

PACEMAKER can use a simple bash script for execution.

PULSECHECK can use Unix shell script for command execution.

APT5 has used the THINBLOOD utility to clear SSL VPN log files located at `/home/runtime/logs`.

APT5 has deleted scripts and web shells to evade detection.

SLIGHTPULSE has the ability to process HTTP GET requests as a normal web server and to insert logic that will read or write files or execute commands in response to HTTP POST requests.

STEADYPULSE can parse web requests made to a targeted server to determine the next stage of execution.

PULSECHECK can check HTTP request headers for a specific backdoor key and if found will output the result of the command in the variable `HTTP_X_CMD.`

SLIGHTPULSE has piped the output from executed commands to `/tmp/1`.

SLOWPULSE can write logged ACE credentials to `/home/perl/PAUS.pm` in append mode, using the format string `%s:%s\n`.

PACEMAKER has written extracted data to `tmp/dsserver-check.statementcounters`.

APT5 has used legitimate account credentials to move laterally through compromised environments.

PACEMAKER can parse `/proc/"process_name"/cmdline` to look for the string `dswsd` within the command line.

STEADYPULSE can add lines to a Perl script on a targeted server to import additional Perl modules.

SLOWPULSE can log credentials on compromised Pulse Secure VPNs during the `DSAuth::AceAuthServer::checkUsernamePassword`ACE-2FA authentication procedure.

PACEMAKER can enter a loop to read `/proc/` entries every 2 seconds in order to read a target application's memory.

SLIGHTPULSE can base64 encode all incoming and outgoing C2 messages.

PULSECHECK can base-64 encode encrypted data sent through C2.

STEADYPULSE can transmit URL encoded data over C2.

STEADYPULSE can URL decode key/value pairs sent over C2.

SLIGHTPULSE can deobfuscate base64 encoded and RC4 encrypted C2 messages.

APT5 has exploited vulnerabilities in externally facing software and devices including Pulse Secure VPNs and Citrix Application Delivery Controllers.

PULSECHECK is a web shell that can enable command execution on compromised servers.

STEADYPULSE is a web shell that can enable the execution of arbitrary commands on compromised web servers.

SLIGHTPULSE is a web shell that can read, write, and execute files on compromised servers.

APT5 has installed multiple web shells on compromised servers including on Pulse Secure VPN appliances.

APT5 has modified legitimate binaries and scripts for Pulse Secure VPNs including the legitimate DSUpgrade.pm file to install the ATRIUM webshell for persistence.

SLOWPULSE can modify LDAP and two factor authentication flows by inspecting login credentials and forcing successful authentication if the provided password matches a chosen backdoor password.

SLOWPULSE can insert malicious logic to bypass RADIUS and ACE two factor authentication (2FA) flows if a designated attacker-supplied password is provided.

SLIGHTPULSE can RC4 encrypt all incoming and outgoing C2 messages.