S1118 BUSHWALK

malwareEnterprise

platformsNetwork Devices

also known asBUSHWALK

BUSHWALK is a web shell written in Perl that was inserted into the legitimate querymanifest.cgi file on compromised Ivanti Connect Secure VPNs during Cutting Edge.

techniques used (6)

ATT&CK techniques this enables or maps to.

T1027Obfuscated Files or Information
T1105Ingress Tool Transfer
T1140Deobfuscate/Decode Files or Information
T1205Traffic Signaling
T1505.003Web Shell
T1554Compromise Host Software Binary

used by campaigns (1)

Campaigns that use this.

C0029Cutting Edge

source

Where this definition is published.

view on ATT&CK

scry

Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan