BUSHWALK
BUSHWALK is a web shell written in Perl that was inserted into the legitimate querymanifest.cgi file on compromised Ivanti Connect Secure VPNs duringCutting Edge.[1][2]
Techniques Used
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Enterprise | T1554 | Compromise Host Software Binary | BUSHWALK can embed into the legitimate | |
| Enterprise | T1140 | Deobfuscate/Decode Files or Information | BUSHWALK can Base64 decode and RC4 decrypt malicious payloads sent through a web request’s command parameter.[1][2] | |
| Enterprise | T1105 | Ingress Tool Transfer | BUSHWALK can write malicious payloads sent through a web request’s command parameter.[1][2] | |
| Enterprise | T1027 | Obfuscated Files or Information | BUSHWALK can encrypt the resulting data generated from C2 commands with RC4.[1] | |
| Enterprise | T1505 | .003 | Server Software Component:Web Shell | BUSHWALK is a web shell that has the ability to execute arbitrary commands or write files.[1] |
| Enterprise | T1205 | Traffic Signaling | BUSHWALK can modify the | |
Campaigns
| ID | Name | Description |
|---|---|---|
| C0029 | Cutting Edge |