BUSHWALK — Malware Profile

BUSHWALK is a web shell written in Perl that was inserted into the legitimate querymanifest.cgi file on compromised Ivanti Connect Secure VPNs during Cutting Edge.

MITRE ATT&CK techniques (6)

• T1027 Obfuscated Files or Information
• T1105 Ingress Tool Transfer
• T1140 Deobfuscate/Decode Files or Information
• T1205 Traffic Signaling
• T1505.003 Web Shell
• T1554 Compromise Host Software Binary

Read the full analysis on IntelFusions