HARDPULSE

HARDPULSE is a webshell used in compromises of Pulse Secure (Pulse Connect Secure) VPN appliances. It is identified as compcheckjava.cgi, with reported SHA256 1d3ab04e21cfd40aa8d4300a359a09e3b520d39b1496be1e4bc91ae1f6730ecc. Mandiant/FireEye associated HARDPULSE with UNC2717, which targeted global government agencies between October 2020 and March 2021; reporting also notes UNC2717 activity at a European organization in March 2021. The broader intrusion set targeted government, defense, and financial organizations and involved exploitation of Pulse Secure vulnerabilities including CVE-2021-22893, alongside older flaws such as CVE-2019-11510, CVE-2020-8243, and CVE-2020-8260.

HARDPULSE supports arbitrary file read and write operations and may execute arbitrary commands via DSSafe::psystem, depending on implementation. It responds to HTTP GET and PUT requests. Reported functionality includes a ReadFile command that accepts a base64-encoded, RC4-encrypted filename via the img parameter and returns file contents base64-encoded and RC4-encrypted with Content-Type application/x-download and a Content-Disposition attachment filename of tmp. A WriteFile command accepts a base64-encoded, RC4-encrypted filename via the cert parameter and base64-encoded, RC4-encrypted file data via the md5 parameter and writes the data to disk. An Execute command accepts base64-encoded, RC4-encrypted commands via the name parameter, blocks the cd command by returning Error 404, redirects command output to /tmp/1 using ">/tmp/1 2>&1", and returns the output base64-encoded and RC4-encrypted while masquerading the response as Content-Type image/gif.

Its command-and-control/data handling uses base64 plus RC4. The first six characters of transmitted data are used as a random per-request nonce, which is combined with a static RC4 phrase to form the RC4 key; the static phrase is not sent over the wire. HARDPULSE also contains an embedded recovery URL of the form https://ive-host/dana-na/auth/recover.cgi?token=<varies>. Additional reporting states attacker interaction used parameters including checkcode, hashid, m, and filename.

Within the Pulse Secure exploitation ecosystem, HARDPULSE was deployed alongside QUIETPULSE and PULSEJUMP by UNC2717. High-confidence indicators directly mentioned in the content include the filename/path compcheckjava.cgi, the embedded recover.cgi tokenized URL path, use of HTTP GET/PUT, parameters img, cert, md5, and name for file and command operations, and temporary output redirection to /tmp/1.