MITRE ATT&CKsoftware (malware)

S1104 SLOWPULSE

Published 2024-02-06 Modified 2025-04-15 Official page ↗

Domain: enterprise
Platforms: Network Devices
Version: 1.1
Created: 2024-02-06

Description

SLOWPULSE is a malware that was used by APT5 as early as 2020 including against U.S. Defense Industrial Base (DIB) companies. SLOWPULSE has several variants and can modify legitimate Pulse Secure VPN files in order to log credentials and bypass single and two-factor authentication flows.

Uses · MITRE ATT&CK (6)

T1556.006 Multi-Factor Authentication sub-technique
T1556.004 Network Device Authentication sub-technique
T1074.001 Local Data Staging sub-technique
T1554 Compromise Host Software Binary technique
T1027 Obfuscated Files or Information technique
T1111 Multi-Factor Authentication Interception technique

Referenced by MITRE ATT&CK · uses (1)

G1023 APT5 group

References

https://www.mandiant.com/resources/blog/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day Mandiant Pulse Secure Zero-Day April 2021

S1104 SLOWPULSE

Description

Related

Uses · MITRE ATT&CK (6)

Referenced by MITRE ATT&CK · uses (1)

References