Mandiant Pulse Secure Update May 2021

APT5 has used the Task Manager process to target LSASS process memory in order to obtain NTLM password hashes. APT5 has also dumped clear text passwords and hashes from memory using Mimikatz hosted through an RDP mapped drive.

APT5 has copied and exfiltrated the SAM Registry hive from targeted systems.

RAPIDPULSE retrieves files from the victim system via encrypted commands sent to the web shell.

APT5 has moved laterally throughout victim environments using RDP.

APT5 has used SSH for lateral movement in compromised environments including for enabling access to ESXi host servers.

RAPIDPULSE has the ability to RC4 encrypt and base64 encode decrypted files on compromised servers prior to writing them to stdout.

APT5 has named exfiltration archives to mimic Windows Updates at times using filenames with a `KB<digits>.zip` pattern.

APT5 has used the BLOODMINE utility to collect data on web requests from Pulse Secure Connect logs.

APT5 has used the CLEANPULSE utility to insert command line strings into a targeted process to alter its functionality.

APT5 has used Windows-based utilities to carry out tasks including tasklist.exe.

APT5 has used PowerShell to accomplish tasks within targeted environments.

APT5 has used cmd.exe for execution on compromised systems.

APT5 has used the THINBLOOD utility to clear SSL VPN log files located at `/home/runtime/logs`.

APT5 has cleared the command history on targeted ESXi servers.

APT5 has deleted scripts and web shells to evade detection.

APT5 has modified file timestamps.

APT5 has staged data on compromised systems prior to exfiltration often in `C:\Users\Public`.

APT5 has accessed Microsoft M365 cloud environments using stolen credentials.

APT5 has used the BLOODMINE utility to discover files with .css, .jpg, .png, .gif, .ico, .js, and .jsp extensions in Pulse Secure Connect logs.

APT5 has created their own accounts with Local Administrator privileges to maintain access to systems with short-cycle credential rotation.

RAPIDPULSE can transfer files to and from compromised hosts.

APT5 has created Local Administrator accounts to maintain access to systems with short-cycle credential rotation.

RAPIDPULSE listens for specific HTTP query parameters in received communications. If specific parameters match, a hard-coded RC4 key is used to decrypt the HTTP query paremter hmacTime. This decrypts to a filename that is then open, read, encrypted with the same RC4 key, base64-encoded, written to standard out, then passed as a response to the HTTP request.

APT5 has exploited vulnerabilities in externally facing software and devices including Pulse Secure VPNs and Citrix Application Delivery Controllers.

APT5 has installed multiple web shells on compromised servers including on Pulse Secure VPN appliances.

RAPIDPULSE is a web shell that is capable of arbitrary file read on targeted web servers to exfiltrate items of interest on the victim device.

APT5 has modified legitimate binaries and scripts for Pulse Secure VPNs including the legitimate DSUpgrade.pm file to install the ATRIUM webshell for persistence.

SLOWPULSE is applied in compromised environments through modifications to legitimate Pulse Secure files.

APT5 has used the JAR/ZIP file format for exfiltrated files.

APT5 has used the BLOODMINE utility to parse and extract information from Pulse Secure Connect logs.

APT5 has used the CLEANPULSE utility to insert command line strings into a targeted process to prevent certain log events from occurring.