Executive Summary
BUSHWALK is a Perl web shell that injects malicious code into *querymanifest.cgi* on Ivanti Connect Secure VPN gateways, granting attackers persistent command execution and data exfiltration capabilities. The compromised gateway can be leveraged for lateral movement within the enterprise, posing significant credential compromise and network egress risks.
Enhanced Description
BUSHWALK is a Perl‑based web shell that attackers deployed by tampering with the legitimate *querymanifest.cgi* script on Ivanti Connect Secure VPN gateways during the so‑named Cutting Edge adversary campaigns reported in early 2024. By inserting malicious code into this CGI executable, threat actors gained persistent access to the internal network through a fully functional command interpreter that can execute arbitrary Perl commands via HTTP requests. The web shell delivers classic capabilities used by intrusion teams: it can read and write files on the VPN gateway, launch arbitrary system commands, exfiltrate sensitive data, and maintain stealth by exploiting the legitimate service path. Because the compromised component is a network‑edge appliance, adversaries can use BUSHWALK to pivot laterally into other internal hosts, enumerate connected devices, or compromise downstream services without triggering immediate alerts. Impact of this intrusion extends beyond the initially infected gateway: attackers obtain privileged access to VPN credentials and can intercept traffic between remote employees and corporate resources. The persistence mechanism—an altered CGI script that restarts automatically with the web server—makes remediation difficult if not detected promptly. Proper monitoring of file integrity on *querymanifest.cgi* and vigilant logging of its execution context are essential for early detection. In the broader threat landscape, BUSHWALK exemplifies a trend where adversaries weaponise legitimate application code to blend into normal traffic patterns, leveraging language interpreters like Perl to maintain lightweight, flexible footholds on network devices.
Key Capabilities
ATT&CK Techniques
Recommended Actions
Suggested Tags
Confidence Assessment
The analysis is based primarily on two Mandiant Cutting Edge reports, which confirm the presence of a Perl web shell within querymanifest.cgi on compromised Ivanti VPN gateways. While the exact command set invoked by BUSHWALK, its persistence beyond the modified CGI script, and any post‑exploitation lateral movement are not fully documented, confidence is high that the malware was inserted to provide remote code execution and data exfiltration capabilities.
BUSHWALK is a web shell written in Perl that was inserted into the legitimate querymanifest.cgi file on compromised Ivanti Connect Secure VPNs during Cutting Edge.(Citation: Mandiant Cutting Edge Part 2 January 2024)(Citation: Mandiant Cutting Edge Part 3 February 2024)