Pulse Connect Secure appliances are being actively exploited in the wild by different malicious actors with different malware families. In order to compromise the Pulse Connect Secure appliances, threat actors are using different vulnerabilities in Pulse Connect Secure, including CVE-2019-11510, CVE-2020-8260, CVE-2020-8243, and a new zero-day vulnerability tracked as CVE-2021-22893.

Active exploitation of Pulse Connect Secure vulnerabilities has been observed since June 2020 and according to the original disclosed investigation report from FireEye Mandiant, at least two separate actors were involved in different incidents starting in March 2021: UNC2717 and UNC2630. The latter actor harvested credentials and backdoored legitimate system binaries to accomplish the following:

• Backdoor binaries to log credentials and bypass authentication flows (SLOWPULSE).
• Inject webshells in administrative web pages (RADIALPULSE and PULSECHECK).
• Make filesystem Read-Write to allow for file modification on a Read-Only filesystem.
• Persist across reboots and system updates performed by the device administrator.
• Evade detection by clearing log files (THINBLOOD), deleting utilities and unpatching binaries after use.