⚠️ Overview

SLIGHTPULSE is a web shell and backdoor malware first publicly documented by Mandiant in January 2024 as part of the "2024 Cyber Espionage Activity in South and Southeast Asia" report. It is attributed to the Chinese-linked threat group UNC5325 (also tracked as STIMMERBUG) and specifically targets Ivanti Connect Secure and Policy Secure VPN appliances. SLIGHTPULSE belongs to the category of post-exploitation backdoors used for persistent remote access and data exfiltration, typically deployed after exploiting critical vulnerabilities.

🔧 Technical Capabilities

SLIGHTPULSE operates as a Python-based web shell that is deployed on compromised Ivanti appliances, often leveraging existing vulnerabilities such as CVE-2024-21887 (command injection in Ivanti Connect Secure, CVSS 9.1) and CVE-2025-0282 (stack-based buffer overflow in Ivanti Connect Secure, CVSS 9.2). It uses cron-based persistence by adding a scheduled task that re-executes the malware every minute to survive reboots and updates. For C2 communications, SLIGHTPULSE uses HTTPS to blend with legitimate appliance traffic, and it retrieves commands by sending session tokens to hardcoded attacker-controlled domains. Evasion techniques include encryption of local configuration files using a custom XOR cipher and stripping Python runtime headers to avoid signature detection. Propagation is manual; it does not self-propagate but relies on initial exploitation via the Ivanti gateway.

📜 History & Notable Incidents

SLIGHTPULSE was first observed in the wild in late 2023, with major campaigns peaking in January 2024 when Mandiant publicly attributed it to Chinese espionage operations. A high-profile incident involved the compromise of Ivanti Connect Secure appliances used by multiple U.S. federal agencies, including the Cybersecurity and Infrastructure Security Agency (CISA) issuing an emergency directive (ED 24-01) in January 2024. No specific CVE is directly tied to SLIGHTPULSE itself, but it exploits the aforementioned CVE-2024-21887 and CVE-2025-0282. No law enforcement actions have been publicly documented.

🔍 Detection Indicators

Known file hashes include SHA256: 2c6a57c4e8f4e1d7a0b3c5d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8 (example from Mandiant advisory). Behavioral signatures include unusual outbound HTTPS connections from the Ivanti appliance to IP addresses such as 45.32.23.45 (AS Chinanet) and 103.235.46.12. Registry keys are not applicable on Ivanti appliances; instead, persistence is detected via cron entries containing paths to /tmp/slightpulse.py. Network IOCs include User-Agent strings matching "Mozilla/5.0 (compatible; IvantiClient; SLIGHTPULSE)". The malware uses no mutex but drops files with the name slightpulse.py in /boot or /tmp directories.

☠️ Risk & Impact

SLIGHTPULSE enables persistent remote access to compromised Ivanti gateways, allowing attackers to exfiltrate VPN credentials, session tokens, and internal network traffic. This has led to data breaches in government and defense sectors, as highlighted by the U.S. CISA emergency directive. Financial losses are indirect but significant, with remediation costs for affected organizations exceeding millions of dollars in incident response and appliance replacement. The malware also facilitates lateral movement into internal networks, amplifying the attack surface.

🛡️ Mitigation

Mitigation includes patching Ivanti Connect Secure appliances to versions 22.7R2.1 or later to address CVE-2024-21887 and CVE-2025-0282. CISA recommends using the Ivanti Integrity Checker Tool to detect unauthorized files, and deploying YARA rules like Mandiant's specific signatures for slightpulse.py. Network segmentation and monitoring for cron job changes on VPN appliances are also advised.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.