H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[BUSHWALK](https://attack.mitre.org/software/S1118) is a web shell written in Perl that was inserted into the legitimate querymanifest.cgi file on compromised Ivanti Connect Secure VPNs during [Cutting Edge](https://attack.mitre.org/campaigns/C0029).(Citation: Mandiant Cutting Edge Part 2 January 2024)(Citation: Mandiant Cutting Edge Part 3 February 2024)

Labels

malware

7 recorded

Relationships

uses

to Compromise Host Software Binary

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Obfuscated Files or Information

Technique

uses

to Traffic Signaling

Technique

uses

Technique

uses

from Cutting Edge

Campaign

3 external

References

mitre-attack

S1118

Mandiant Cutting Edge Part 3 February 2024

https://www.mandiant.com/resources/blog/investigating-ivanti-exploitation-persistence

Mandiant Cutting Edge Part 2 January 2024

https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation