BUSHWALK

MITRE

Malware Type:
Other

First seen:
Unknown

Last seen:
Unknown

Details:

[BUSHWALK](https://attack.mitre.org/software/S1118) is a web shell written in Perl that was inserted into the legitimate querymanifest.cgi file on compromised Ivanti Connect Secure VPNs during [Cutting Edge](https://attack.mitre.org/campaigns/C0029).(Citation: Mandiant Cutting Edge Part 2 January 2024)(Citation: Mandiant Cutting Edge Part 3 February 2024)

Associated Techniques (6)

ID	ATT&CK	Tactics
T1027	Obfuscated Files or Information	-
T1105	Ingress Tool Transfer	-
T1140	Deobfuscate/Decode Files or Information	-
T1205	Traffic Signaling	-
T1505.003	Web Shell	-
T1554	Compromise Host Software Binary	-

Metadata

ID:	106
Created:	13/01/2026 17:48
Updated:	06/03/2026 16:00