In many instances, the attackers took advantage of an authentication bypass vulnerability in the Pulse Connect Secure (PCS) appliance (CVE-2021-22893) and a combination of previously known vulnerabilities to gain initial access on a victim network. The authentication bypass flaw was discovered and patched last month — but only after attackers had begun exploiting it in the wild. However, Mandiant researchers were often unable to determine an initial access vector because the threat actors deleted or altered forensic evidence or the Pulse Secure appliance itself had gone through software updates that destroyed evidence of initial compromise. Mandiant's warning this week on the advanced persistent threat (APT) activity from China targeted at US and European companies is an update to a warning it had issued last month on the same issue. In that alert, Mandiant had reported on two China-based groups — UNC2630 and UNC2717 — using a battery of malware tools to target vulnerabilities in Pulse Secure VPN appliances. Mandiant said it had observed UNC2630 targeting organizations in the US defense industrial base and UNC2717 hitting an organization in the EU. The Mandiant report offered an analysis of 12 malware code families that the security vendor said it had observed the attackers using to specifically target vulnerabilities in Pulse Secure VPN appliances.