MalwareUsed by 2 actorsExploits 3 CVEs

BUSHWALK

BUSHWALK is a Perl webshell associated with UNC5221 that targets compromised Ivanti Connect Secure VPN appliances. It embeds malicious functionality into a legitimate CGI component, providing persistent remote access for arbitrary command execution and file writing. Its command-execution action returns command output encrypted with RC4 and encoded with Base64, while its file-writing action decodes supplied content and appends it to an attacker-specified file. Malicious functionality is activated through a specific HTTP request parameter value.

BUSHWALK was deployed in targeted operations that bypassed Ivanti's January 2024 mitigations, with the mitigation bypass tracked as CVE-2024-21893. Its deployment formed part of post-exploitation activity against internet-facing VPN infrastructure. BUSHWALK was also observed during the intrusion into MITRE's Networked Experimentation, Research, and Virtualization Environment, where a variant contained modified command-handling logic and an additional data-export routine.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

3 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

3 CVES

CVE-2023-46805Authentication bypass in Ivanti Connect Secure and Policy SecureExploited in the wild

Cyber threat actors are actively exploiting multiple previously identified vulnerabilities—CVE-2023-46805, CVE-2024-21887, and CVE-2024-21893—affecting Ivanti Connect Secure and Ivanti Policy Secure gateways.

via cisa advisoriescisa.gov

CVE-2024-21893Unauthenticated SAML SSRF in Ivanti Connect Secure, Policy Secure, and Neurons for ZTAExploited in the wild

Ivanti disclosed three additional vulnerabilities: CVE-2024-21893 is a server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) Ivanti Policy Secure (9.x, 22.x), and Ivanti Neurons for ZTA...

via cisa advisoriescisa.gov

CVE-2024-21887Command Injection in Ivanti Connect Secure and Policy SecureExploited in the wild

Volexity reported on two vulnerabilities in Ivanti Connect Secure and Ivanti Policy Secure gateways observed being chained to achieve unauthenticated remote code execution (RCE): CVE-2023-46805, CVE-2024-21887.

via cisa advisoriescisa.gov

THREAT ACTORS

Groups observed using it

2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

UNC5221

The group has been observed using other distinct malware including CHAINLINE backdoor, FRAMESTING webshell, WIREFIRE webshell, LIGHTWIRE webshell, BUSHWALK webshell.

via polyswarmblog.polyswarm.io

UNC5325

In our previous blog post, we described a mitigation bypass that was used to drop a newly identified BUSHWALK webshell.

via mandiant threat intelligencecloud.google.com

MITRE ATT&CK

Techniques & procedures

12 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1190Exploit Public-Facing ApplicationEvidence1

“cyber threat actors are exploiting… vulnerabilities… affecting Ivanti Connect Secure and Ivanti Policy Secure gateways… used in a chain of exploits to enable… bypass authentication… execute arbitrary commands with elevated privileges.” / “Volexity… observed being chained to achieve unauthenticated remote code execution (RCE)”

Execution

2 techniques

T1203Exploitation for Client ExecutionEvidence1

“Cyber actors will exploit software vulnerabilities such as command-injection and achieve unauthenticated remote code execution (RCE).”

T1574Hijack Execution FlowEvidence1

During the 2016 Ukraine Electric Power Attack, Sandworm Team used a trojanized version of Windows Notepad to add a layer of persistence for Industroyer.

Persistence

3 techniques

T1205Traffic SignalingEvidence2

T1505.003Web ShellEvidence4

The adversary accessed VMs and deployed malicious payloads, including the BRICKSTORM backdoor and a web shell MITRE called BEEFLUSH.

T1554Compromise Host Software BinaryEvidence2

Stealth

4 techniques

T1027Obfuscated Files or InformationEvidence4

The content repeatedly describes malware and threat actors using obfuscated code, encrypted strings, Base64/XOR/RC4/AES encoding, VMProtect/ConfuserEx/SmartAssembly, stack strings, control-flow flattening, opaque predicates, and hidden payloads to evade analysis and detection.

T1140Deobfuscate/Decode Files or InformationEvidence5

The content repeatedly describes malware and threat actors decoding, decrypting, deobfuscating, or unpacking payloads, strings, configuration data, commands, and C2 responses prior to execution or use.

T1205Traffic SignalingEvidence2

T1574Hijack Execution FlowEvidence1

During the 2016 Ukraine Electric Power Attack, Sandworm Team used a trojanized version of Windows Notepad to add a layer of persistence for Industroyer.

Collection

1 technique

T1074Data StagedEvidence1

the adversary used the Ivanti help website as a staging area for data exfiltration

Command and Control

3 techniques

T1071Application Layer ProtocolEvidence1

BEEFLUSH ... communicated with several internal IP addresses making POST requests.

T1105Ingress Tool TransferEvidence2

T1205Traffic SignalingEvidence2

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

The adversary exfiltrated data from the NERVE using command-and-control infrastructure.

INDICATORS OF COMPROMISE

IOCs tracked for this family

1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

1 tracked

IPs, domains, and DNS infrastructure linked to this family.

TypeValueLatest sighting

ip.v4●●●●●●●●●●●●View more in app2 years ago

ACTIVITY FEED

Recent activity

7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

7 SOURCESView more in app

polyswarmNews

Oct 5, 2026

KrustyLoader Backdoor

Webshell mentioned as part of UNC5221's broader malware arsenal; no operational details are provided.

medium mitre engenuityNews

May 9, 2024

Technical Deep Dive: Understanding the Anatomy of a Cyber Intrusion | Center for Threat-Informed Defense

A Perl web shell that provides file read/write capability on a server; the version observed by MITRE differed from prior reporting by including a different ValidateVersion subroutine and a new exportData subroutine.

mitre attack websiteNews

Jun 1, 2017

Compromise Host Software Binary, Technique T1554 - Enterprise | MITRE ATT&CK®

Malware that embeds itself into a legitimate Ivanti Connect Secure VPN CGI component for persistence.

mitre attackNews

Jan 24, 2026

Server Software Component: Web Shell, Sub-technique T1505.003 - Enterprise | MITRE ATT&CK®

Web shell enabling arbitrary command execution and file write capability on compromised systems.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching1

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution2

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities3

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping12

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

BUSHWALK