UNC2717

Reports per quarter

Techniques seen in the last two years

• T1003 1 report
• T1016 1 report
• T1021.001 1 report
• T1027 1 report
• T1036.005 1 report
• T1048 1 report
• T1049 1 report
• T1053 1 report
• T1057 1 report
• T1059 1 report

Counts come from technique IDs in the actor's report text.

CVEs named in reports

• CVE-2021-20021 KEV ransomware
• CVE-2021-20023 KEV ransomware
• CVE-2021-22893 KEV ransomware

KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.

Reports

1. 6 April 2026

   Authentication Bypass Techniques and Pulse Secure Zero-Day

   date ORKL added it fromORKL

   Archived copy on ORKL Detailsfor Authentication Bypass Techniques and Pulse Secure Zero-Day

2. 6 April 2026

   Re-Checking Your Pulse: Updates on Chinese APT Actors Compromising Pulse Secure VPN Devices | Mandiant

   date ORKL added it fromORKL

   Archived copy on ORKL Detailsfor Re-Checking Your Pulse: Updates on Chinese APT Actors Compromising Pulse Secure VPN Devices | Mandiant

3. 3 June 2021

   Chinese threat actors hacked NYC MTA using Pulse Secure zero-day

   date in the title fromORKL

   The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Chinese threat actors hacked NYC MTA using Pulse Secure zero-day

4. 27 May 2021

   Re-Checking Your Pulse- Updates on Chinese APT Actors Compromising Pulse Secure VPN Devices

   date in the title fromORKL

   The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Re-Checking Your Pulse- Updates on Chinese APT Actors Compromising Pulse Secure VPN Devices

5. 27 May 2021

   Re-Checking Your Pulse: Updates on Chinese APT Actors Compromising Pulse Secure VPN Devices | Mandiant

   Malpedia library date fromORKL

   Archived copy on ORKL Detailsfor Re-Checking Your Pulse: Updates on Chinese APT Actors Compromising Pulse Secure VPN Devices | Mandiant

6. 21 April 2021

   Check Your Pulse_ Suspected APT Actors Leverage Authentication Bypass Techniques and Pulse Secure Zero-Day _ FireEye Inc

   file creation date fromORKL

   The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Check Your Pulse_ Suspected APT Actors Leverage Authentication Bypass Techniques and Pulse Secure Zero-Day _ FireEye Inc

7. 20 April 2021

   Check Your Pulse- Suspected APT Actors Leverage Authentication Bypass Techniques and Pulse Secure Zero-Day

   date in the title fromORKL

   The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Check Your Pulse- Suspected APT Actors Leverage Authentication Bypass Techniques and Pulse Secure Zero-Day

Newest first. Details opens the report in Explore.