Malware: BUSHWALK

Description

[BUSHWALK](https://attack.mitre.org/software/S1118) is a web shell written in Perl that was inserted into the legitimate querymanifest.cgi file on compromised Ivanti Connect Secure VPNs during [Cutting Edge](https://attack.mitre.org/campaigns/C0029).(Citation: Mandiant Cutting Edge Part 2 January 2024)(Citation: Mandiant Cutting Edge Part 3 February 2024)

External References

• mitre-attack
• Mandiant Cutting Edge Part 3 February 2024
• Mandiant Cutting Edge Part 2 January 2024

Techniques Used by This Malware

• T1027 — Obfuscated Files or Information
• T1105 — Ingress Tool Transfer
• T1140 — Deobfuscate/Decode Files or Information
• T1205 — Traffic Signaling
• T1505.003 — Web Shell
• T1554 — Compromise Host Software Binary