Loading malware…
BUSHWALK is a Perl-based web shell used on compromised Ivanti Connect Secure VPN appliances. It is associated with exploitation activity targeting Ivanti appliances in early 2024 and has been tied to the China-nexus espionage cluster UNC5221. The malware can be embedded into a legitimate appliance component, specifically the querymanifest.cgi functionality, allowing it to blend into normal device files while providing covert remote access.
BUSHWALK supports arbitrary command execution and file-writing on the compromised device, making it useful for post-exploitation operations, persistence, and follow-on payload deployment. It was observed as part of broader intrusion chains involving exploitation of Ivanti Connect Secure vulnerabilities, including campaigns where attackers bypassed initial vendor mitigations to deploy updated web shell variants such as BUSHWALK, LIGHTWIRE, and CHAINLINE. In victim environments, BUSHWALK has appeared alongside other appliance-focused malware and web shells including ROOTROT, WIREFIRE, BEEFLUSH, and FRAMESTING.
Operationally, BUSHWALK has been used to maintain access to edge infrastructure and support espionage-oriented intrusions. Activity involving this web shell has been linked to compromises that enabled credential abuse, session hijacking, lateral movement into internal environments, and data theft. The malware is particularly relevant to organizations operating Ivanti Connect Secure remote access infrastructure, including high-value enterprise and government-adjacent networks targeted by sophisticated threat actors.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Cyber threat actors are actively exploiting multiple previously identified vulnerabilities—CVE-2023-46805, CVE-2024-21887, and CVE-2024-21893—affecting Ivanti Connect Secure and Ivanti Policy Secure gateways.
Ivanti disclosed three additional vulnerabilities: CVE-2024-21893 is a server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) Ivanti Policy Secure (9.x, 22.x), and Ivanti Neurons for ZTA...
Volexity reported on two vulnerabilities in Ivanti Connect Secure and Ivanti Policy Secure gateways observed being chained to achieve unauthenticated remote code execution (RCE): CVE-2023-46805, CVE-2024-21887.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
An external IP address... made network traffic requests to the BUSHWALK web shell... BUSHWALK, also tied to UNC5221 according to Google-owned Mandiant, is written in Perl.
In our previous blog post, we described a mitigation bypass that was used to drop a newly identified BUSHWALK webshell.
12 distinct techniques documented for this family, organized by ATT&CK tactic.
“cyber threat actors are exploiting… vulnerabilities… affecting Ivanti Connect Secure and Ivanti Policy Secure gateways… used in a chain of exploits to enable… bypass authentication… execute arbitrary commands with elevated privileges.” / “Volexity… observed being chained to achieve unauthenticated remote code execution (RCE)”
The content repeatedly describes malware and threat actors using obfuscated code, encrypted strings, Base64/XOR/RC4/AES encoding, VMProtect/ConfuserEx/SmartAssembly, stack strings, control-flow flattening, opaque predicates, and hidden payloads to evade analysis and detection.
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Perl web shell that provides file read/write capability on a server; the version observed by MITRE differed from prior reporting by including a different ValidateVersion subroutine and a new exportData subroutine.
Malware that embeds itself into a legitimate Ivanti Connect Secure VPN CGI component for persistence.
Web shell enabling arbitrary command execution and file write capability on compromised systems.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.