BUSHWALK - S1118 (29a0bb87-1162-4c83-9834-2a98a876051b)

BUSHWALK is a web shell written in Perl that was inserted into the legitimate querymanifest.cgi file on compromised Ivanti Connect Secure VPNs during Cutting Edge.(Citation: Mandiant Cutting Edge Part 2 January 2024)(Citation: Mandiant Cutting Edge Part 3 February 2024)

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
BUSHWALK - S1118 (29a0bb87-1162-4c83-9834-2a98a876051b)	Malware	Compromise Host Software Binary - T1554 (960c3c86-1480-4d72-b4e0-8c242e84a5c5)	Attack Pattern	1
Deobfuscate/Decode Files or Information - T1140 (3ccef7ae-cb5e-48f6-8302-897105fbf55c)	Attack Pattern	BUSHWALK - S1118 (29a0bb87-1162-4c83-9834-2a98a876051b)	Malware	1
BUSHWALK - S1118 (29a0bb87-1162-4c83-9834-2a98a876051b)	Malware	Ingress Tool Transfer - T1105 (e6919abc-99f9-4c6c-95a5-14761e7b2add)	Attack Pattern	1
BUSHWALK - S1118 (29a0bb87-1162-4c83-9834-2a98a876051b)	Malware	Traffic Signaling - T1205 (451a9977-d255-43c9-b431-66de80130c8c)	Attack Pattern	1
Obfuscated Files or Information - T1027 (b3d682b6-98f2-4fb0-aa3b-b4df007ca70a)	Attack Pattern	BUSHWALK - S1118 (29a0bb87-1162-4c83-9834-2a98a876051b)	Malware	1
Web Shell - T1505.003 (5d0d3609-d06d-49e1-b9c9-b544e0c618cb)	Attack Pattern	BUSHWALK - S1118 (29a0bb87-1162-4c83-9834-2a98a876051b)	Malware	1
Web Shell - T1505.003 (5d0d3609-d06d-49e1-b9c9-b544e0c618cb)	Attack Pattern	Server Software Component - T1505 (d456de47-a16f-4e46-8980-e67478a12dcb)	Attack Pattern	2