H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Malware

SLIGHTPULSE

[SLIGHTPULSE](https://attack.mitre.org/software/S1110) is a web shell that was used by [APT5](https://attack.mitre.org/groups/G1023) as early as 2020 including against Pulse Secure VPNs at US Defense Industrial Base (DIB) entities.(Citation: Mandiant Pulse Secure Zero-Day April 2021)

Malware
TypeMalware
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[SLIGHTPULSE](https://attack.mitre.org/software/S1110) is a web shell that was used by [APT5](https://attack.mitre.org/groups/G1023) as early as 2020 including against Pulse Secure VPNs at US Defense Industrial Base (DIB) entities.(Citation: Mandiant Pulse Secure Zero-Day April 2021)

Labels

malware
10 recorded

Relationships

uses
from APT5
Group
uses
to Command and Scripting Interpreter
Technique
uses
to Data from Local System
Technique
uses
to Deobfuscate/Decode Files or Information
Technique
uses
to Ingress Tool Transfer
Technique
uses
to Local Data Staging
Technique
uses
to Standard Encoding
Technique
uses
to Symmetric Cryptography
Technique
uses
to Web Protocols
Technique
uses
to Web Shell
Technique
2 external

References

mitre-attack
S1110
open
Mandiant Pulse Secure Zero-Day April 2021
https://www.mandiant.com/resources/blog/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance