MalwareUsed by 2 actorsExploits 3 CVEs

BUSHWALK

BUSHWALK is a Perl web shell deployed on compromised Ivanti Connect Secure VPN appliances and associated with UNC5221, a suspected China-nexus cyberespionage actor. It embeds malicious functionality into a legitimate appliance CGI component, providing persistent remote access while blending into existing software. Its core capabilities include arbitrary command execution and writing attacker-supplied content to files. It processes commands using Base64 decoding and RC4 decryption and returns command output encrypted with RC4 and encoded with Base64. A separate action decodes supplied content and appends it to a designated file. BUSHWALK was deployed during targeted exploitation that bypassed Ivanti's January 2024 mitigations, with the bypass subsequently tracked as CVE-2024-21893. It was also observed during the intrusion into MITRE's Networked Experimentation, Research, and Virtualization Environment, where a variant contained modified request-handling logic and an additional data-export subroutine. BUSHWALK functions as a post-exploitation implant rather than the initial vulnerability exploit.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

3 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

3 CVES

CVE-2023-46805Ivanti Connect Secure and Policy Secure Authentication BypassExploited in the wild

Cyber threat actors are actively exploiting multiple previously identified vulnerabilities—CVE-2023-46805, CVE-2024-21887, and CVE-2024-21893—affecting Ivanti Connect Secure and Ivanti Policy Secure gateways.

via cisa advisoriescisa.gov

CVE-2024-21893SSRF Authentication Bypass in Ivanti Connect Secure SAMLExploited in the wild

Ivanti disclosed three additional vulnerabilities: CVE-2024-21893 is a server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) Ivanti Policy Secure (9.x, 22.x), and Ivanti Neurons for ZTA...

via cisa advisoriescisa.gov

CVE-2024-21887Ivanti Connect Secure and Policy Secure Command InjectionExploited in the wild

Volexity reported on two vulnerabilities in Ivanti Connect Secure and Ivanti Policy Secure gateways observed being chained to achieve unauthenticated remote code execution (RCE): CVE-2023-46805, CVE-2024-21887.

via cisa advisoriescisa.gov

THREAT ACTORS

Groups observed using it

2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

UNC5221

A mitigation bypass technique was recently identified that led to the deployment of a custom webshell tracked as BUSHWALK.

via mandiant threat intelligencecloud.google.com

UNC5325

In our previous blog post, we described a mitigation bypass that was used to drop a newly identified BUSHWALK webshell.

via mandiant threat intelligencecloud.google.com

MITRE ATT&CK

Techniques & procedures

12 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1190Exploit Public-Facing ApplicationEvidence1

“cyber threat actors are exploiting… vulnerabilities… affecting Ivanti Connect Secure and Ivanti Policy Secure gateways… used in a chain of exploits to enable… bypass authentication… execute arbitrary commands with elevated privileges.” / “Volexity… observed being chained to achieve unauthenticated remote code execution (RCE)”

Execution

2 techniques

T1203Exploitation for Client ExecutionEvidence1

“Cyber actors will exploit software vulnerabilities such as command-injection and achieve unauthenticated remote code execution (RCE).”

T1574Hijack Execution FlowEvidence1

During the 2016 Ukraine Electric Power Attack, Sandworm Team used a trojanized version of Windows Notepad to add a layer of persistence for Industroyer.

Persistence

3 techniques

T1205Traffic SignalingEvidence1

T1505.003Web ShellEvidence3

The adversary accessed VMs and deployed malicious payloads, including the BRICKSTORM backdoor and a web shell MITRE called BEEFLUSH.

T1554Compromise Host Software BinaryEvidence1

Stealth

4 techniques

T1027Obfuscated Files or InformationEvidence3

The content repeatedly describes malware and threat actors using obfuscated code, encrypted strings, Base64/XOR/RC4/AES encoding, VMProtect/ConfuserEx/SmartAssembly, stack strings, control-flow flattening, opaque predicates, and hidden payloads to evade analysis and detection.

T1140Deobfuscate/Decode Files or InformationEvidence4

The content repeatedly describes malware and threat actors decoding, decrypting, deobfuscating, or unpacking payloads, strings, configuration data, commands, and C2 responses prior to execution or use.

T1205Traffic SignalingEvidence1

T1574Hijack Execution FlowEvidence1

During the 2016 Ukraine Electric Power Attack, Sandworm Team used a trojanized version of Windows Notepad to add a layer of persistence for Industroyer.

Collection

1 technique

T1074Data StagedEvidence1

the adversary used the Ivanti help website as a staging area for data exfiltration

Command and Control

3 techniques

T1071Application Layer ProtocolEvidence1

BEEFLUSH ... communicated with several internal IP addresses making POST requests.

T1105Ingress Tool TransferEvidence1

T1205Traffic SignalingEvidence1

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

The adversary exfiltrated data from the NERVE using command-and-control infrastructure.

INDICATORS OF COMPROMISE

IOCs tracked for this family

1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

1 tracked

IPs, domains, and DNS infrastructure linked to this family.

TypeValueLatest sighting

ip.v4●●●●●●●●●●●●View more in app2 years ago

ACTIVITY FEED

Recent activity

6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

6 SOURCESView more in app

medium mitre engenuityNews

May 9, 2024

Technical Deep Dive: Understanding the Anatomy of a Cyber Intrusion | Center for Threat-Informed Defense

A Perl web shell that provides file read/write capability on a server; the version observed by MITRE differed from prior reporting by including a different ValidateVersion subroutine and a new exportData subroutine.

mitre attack websiteNews

Jun 1, 2017

Compromise Host Software Binary, Technique T1554 - Enterprise | MITRE ATT&CK®

Malware that embeds itself into a legitimate Ivanti Connect Secure VPN CGI component for persistence.

mitre attackNews

Jan 24, 2026

Server Software Component: Web Shell, Sub-technique T1505.003 - Enterprise | MITRE ATT&CK®

Web shell enabling arbitrary command execution and file write capability on compromised systems.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching1

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution2

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities3

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping12

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

BUSHWALK