QUIETPULSE
QUIETPULSE is malware used in compromises of Pulse Secure (Pulse Connect Secure) VPN appliances. It was observed in activity tracked by Mandiant/FireEye as UNC2717, which targeted global government agencies between October 2020 and March 2021. The malware modifies the legitimate Perl script dsserver (SHA256: 9f6ac39707822d243445e30d27b8404466aa69c61119d5308785bf4a464a9ebd) so that it forks and executes /home/bin/dshelper. The associated dshelper script (SHA256: c774eca633136de35c9d2cd339a3b5d29f00f761657ea2aa438de4f33e4bbba4) runs in a loop every two minutes and functions as a utility script responsible for copying files and executing commands. It is used to maintain persistence, including copying or restoring malicious files into /tmp/data during upgrades and modifying integrity checks. QUIETPULSE was reported alongside HARDPULSE and PULSEJUMP in UNC2717 intrusions against government victims. The broader intrusion set involved exploitation of Pulse Secure vulnerabilities, including CVE-2021-22893 and previously disclosed flaws, to gain access to appliances and maintain long-term access.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
4 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
"...newly discovered critical zero-day authentication bypass vulnerability (CVE-2021-22893) that is currently being exploited in the wild and for which there is no patch available yet." ... "Ivanti ... has released temporary mitigations to address the arbitrary file execution vulnerability (CVE-2021-22893, CVSS score: 10)"
"UNC2717 - HARDPULSE, QUIETPULSE, AND PULSEJUMP"
"UNC2717 - HARDPULSE, QUIETPULSE, AND PULSEJUMP"
"UNC2717 - HARDPULSE, QUIETPULSE, AND PULSEJUMP"
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Techniques & procedures
6 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 technique"...zero-day authentication bypass vulnerability in the Pulse Connect Secure (PCS) SSL VPN appliance actively exploited... vulnerability tracked as CVE-2021-22893... exploited in the wild... to hack the networks... and execute arbitrary code remotely on Pulse Connect Secure gateways."
Persistence
3 techniques"QUIETPULSE... modified... to fork the child process /home/bin/dshelper"; dshelper loop re-inserts webshell code and ensures dsserver/dshelper persist in /tmp/data across upgrades.
"They modified scripts on the Pulse Secure system which enabled the malware to survive software updates and factory resets."
Privilege Escalation
2 techniques"QUIETPULSE... modified... to fork the child process /home/bin/dshelper"; dshelper loop re-inserts webshell code and ensures dsserver/dshelper persist in /tmp/data across upgrades.
Defense Impairment
1 techniqueCredential Access
2 techniques"They developed malware that enabled them to harvest Active Directory credentials..."
Other
1 techniqueIOCs tracked for this family
2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Custom malware family associated with exploitation of Pulse Secure VPN appliances during intrusions attributed to UNC2717.
Malware used by UNC2717 in Pulse Secure compromises; part of a toolset enabling persistent access and credential harvesting.
Persistence/utility tooling where a modified dsserver forks a non-standard helper script (dshelper) that repeatedly checks and re-inserts malicious modifications into upgrade-staged files under /tmp/data, helping maintain backdoors/webshells and tamper with integrity checks across upgrades.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.