April 2021’s Pulse Secure disclosures capped a stretch in which VPN appliances — the machinery of pandemic remote work — became the most breached edge class on the internet. Attackers chained Pulse Secure pre-auth bugs into extortion readiness and data theft at defence, critical-infrastructure and enterprise targets, and the associated incident response shaped CISA emergency directives for months. The lesson: anything that terminates remote access is tier-0 infrastructure, and legacy appliances cannot be treated as set-and-forget networking gear.
Ivanti Pulse Secure Connect Secure VPN appliances were exploited in the wild via pre-authentication vulnerabilities (CVE-2021-22893 and companions) disclosed and patched across April–May 2021. APT actors — most prominently a cluster tracked as UNC2630, with ties to ransomware operators — gained administrator-level control of the VPN appliances, captured credentials and sessions, forged authentication state, and in some cases used a custom malware lineage (“tradefft”/SLOWPULSE-style tooling) for persistence that survived patching. CISA issued Emergency Directive 21-03 ordering federal agencies to patch, hunt, and report. The case established the modern edge-appliance IR standard: patch is not cleanup — you must image-rebuild and credential-reset, because appliance-resident malware survives updates.
What happened
The saga began before April: in March 2021, FireEye/FireEye-owned Mandiant reported active exploitation of Pulse Secure VPNs (CVE-2021-22893, a pre-auth RCE-class flaw in the web interface, alongside related bugs CVE-2021-22890/22894/22899) against US defence contractors and critical-infrastructure entities — opportunistic but sensitive targets. Ivanti (Pulse’s parent) released patches progressively in April; CISA’s Emergency Directive 21-03 (April 20) compelled federal agencies to act within days, reflecting how pervasive the exploitation already was.
The attackers’ objectives were classic: harvest AD credentials from the authentication flow traversing the appliance, plant web shells and malicious license/plug-in files for persistence, and pivot toward ransomware deployment (affiliates of some crews were observed staging). Mandiant’s tracking tied exploitation to clusters including UNC2630 and UNC2717, with tooling uniquely adapted to Pulse’s appliance filesystem — meaning generic detections missed it, and the persistence survived reboots and even some patch operations, because the malware lived in locations the update process preserved.
For the wider community, April 2021’s Pulse crisis merged two previously separate conversations: APT edge-device campaigns (usually espionage) and ransomware initial-access economics (usually crime). The same appliance was both a spy entry point and a crime gateway — with shared downstream needs: rebuild-from-image, reset all credentials that traversed the box, and audit for persistence in vendor-specific paths. That merged doctrine now governs every edge-device incident class: from Fortinet to Ivanti to Citrix.
How it worked
The exploitation chain combined authenticated/unauthenticated flaws into full appliance takeover, then abused the appliance’s trusted position for credential capture:
(1) pre-auth exploit (CVE-2021-22893 family)
internet -> Pulse web interface -> RCE as appliance service account
(2) credential + session theft
- authentication flow logs/config: usernames, some password material
- session tokens forged; MFA bypass via re-entering auth flow
(3) persistence in appliance-preserved paths
- malicious "license" files / custom CGIs / modified legit binaries
- survives reboot; in some cases survives patching w/o factory reset
(4) lateral movement
- appliance holds service accounts + AD trust (LDAP/SAML)
- pass-through auth grants usable enterprise identities
(5) objectives split
- espionage clusters: data staging + long dwell
- ransomware affiliates: deploy encryptor via captured admin credsTwo design lessons anchor modern guidance. First, an authentication terminator sees everything: every credential, token, and session that crosses a VPN concentrator should be treated as exposed if the box is compromised — because capturing them is trivial for appliance-level attackers. Second, appliance update pipelines were not designed for compromise recovery: updates replace code, not state, and attacker files parked in data/config paths ride along. Hence the now-standard rule: compromised edge appliances get factory-imaged, config-rebuilt from clean sources, and every credential rotated — verifying against vendor IR checklists, as we detail in the infrastructure edge-hardening guide.
Impact and numbers
| Metric | Value | Source |
|---|---|---|
| Key CVEs | CVE-2021-22893 (pre-auth RCE), -22890, -22894, -22899 | Ivanti advisories |
| Exploitation observed | In the wild before disclosure (defence, critical infra targets) | Mandiant/peer-security reporting |
| CISA directive | Emergency Directive 21-03 (2021-04-20) | CISA |
| Actor clusters | UNC2630 / UNC2717; ransomware-affiliate overlaps | Mandiant tracking |
| Persistence tooling | Appliance-native files (license/CGI paths), reboot+patch surviving | IR vendor analyses |
| Victim classes | US defence contractors, agencies, critical infrastructure, global enterprises | press + advisories |
Timeline
| Date | Event |
|---|---|
| 2021-03 | Mandiant reports APT exploitation of Pulse Connect Secure |
| 2021-04-09/20 | Ivanti patch wave; CISA Emergency Directive 21-03 |
| 2021-04/05 | Global hunting: shells, forged sessions, credential resets |
| 2021 (year) | Doctrine solidifies: image-rebuild + rotate-all rule for edge appliances |
| 2023–2025 | Same class recurs: Ivanti EPMM/Connect, Citrix Bleed etc. |
Why it still matters in 2026
Pulse Secure 2021 is the founding case of the edge-appliance crisis era that has not stopped since — Fortinet SSL-VPN flaws, Ivanti’s own later Connect/EPMM emergencies, Citrix Bleed, and the endless SSL-VPN scanner economy. The 2021 event wrote the response script everyone now follows: emergency patch SLA for internet-facing access infrastructure, vendor-specific IR checklists for persistence, factory-image recovery, and credential-reset scope covering everything the appliance ever saw, our retrospective on the zero-day surge era tracks how this class became the #1 initial-access vector for both ransomware and espionage. And architecturally, it is the strongest argument in the modernisation stack for passwordless, phishing-resistant identity: the less credential secrets flow through any single concentrator, the smaller the prize when it falls.
Detection and hardening takeaways
- Treat VPN/remote-access appliances as tier-0. They authenticate your whole workforce; patch them on a same-day clock for critical bugs, and never expose their admin interfaces to the internet.
- Assume credential exposure on compromise. Any account that authenticated through a compromised appliance gets rotated — including service accounts and MFA registrations. Forgery of sessions means “MFA was on” is not an exemption.
- Rebuild, don’t just patch. Appliance malware survives updates via preserved paths (licenses, CGIs, data stores). Follow vendor IR checklists; where feasible factory-image and restore config from trusted sources.
- Monitor the appliance like a server. Config changes, new files in web roots, unusual admin logins, and unexpected outbound connections from the appliance subnet are the highest-signal lines — appliance telemetry exists; most estates never baseline it.
- Plan for the disclosure-to-patch gap. Exploitation here preceded disclosure; maintain WAF/virtual-patch rules, geo/rate throttles, and even temporary access re-routing options for the window before fixes land.
FAQ
What was SLOWPULSE?
A label used by researchers (Mandiant lineage) for Pulse-specific malicious tooling — backdoored license files and custom CGIs that let attackers keep access and re-enter authentication flows. Its significance was survival: because it lived in paths the patch process preserved, victims who patched without a persistence hunt remained compromised. The name is now shorthand for vendor-filesystem-native malware in edge appliances.
Were MFA users safe?
No. Attackers with appliance control could intercept or replay authentication exchanges, and forged session state bypassed the need to re-authenticate. MFA protects the front door; it does not protect a compromised door-keeper. The correct response was rotating credentials AND MFA registrations/seed material where the appliance touched them.
Why did this class keep recurring after 2021?
Root cause: market concentration + legacy codebases + always-on internet exposure. A handful of vendors own remote-access concentrator estates; their codebases predate modern memory-safe practices, and their deployment model (internet-facing, high-value identity concentrated) makes them ideal initial-access terrain. Until concentrations thin or architectures de-credential (zero-trust agent models), the class will keep producing Pulse-like events — which is why the rebuild+rotate doctrine written in April 2021 remains standard today.
