BUSHWALK
- ID
- S1118
- Type
- Malware
- Platforms
- Network Devices
- Source
- attack.mitre.org
- MITRE last modified
- 16 Apr 2025
BUSHWALK is a web shell written in Perl that was inserted into the legitimate querymanifest.cgi file on compromised Ivanti Connect Secure VPNs during Cutting Edge.[1][2]
Techniques used (6)
- T1027 Obfuscated Files or Information
- T1105 Ingress Tool Transfer
- T1140 Deobfuscate/Decode Files or Information
- T1205 Traffic Signaling
- T1505.003 Web Shell
- T1554 Compromise Host Software Binary