⚠️ Overview

BUSHWALK is a C++ backdoor first publicly documented by Mandiant (now part of Google Cloud) in their June 2020 report on the threat group APT41 (also tracked as Winnti, TA413, or Bronze President). It belongs to the Remote Access Trojan (RAT) category and is used for targeted espionage and data theft. APT41 is a Chinese-state-sponsored cyberespionage group with a parallel financially motivated branch, and BUSHWALK serves as a second-stage implant deployed after initial compromise.

🔧 Technical Capabilities

BUSHWALK communicates with its command-and-control (C2) infrastructure over HTTPS using a custom encrypted protocol that mimics legitimate web traffic. It achieves persistence by writing a copy of itself to disk and creating a registry Run key under HKCUSoftwareMicrosoftWindowsCurrentVersionRun with the value name BushWalk. The malware checks for a global mutex named GlobalBushWalkMutex to prevent multiple instances. Evasion techniques include API hashing, string obfuscation, and dynamic resolution of Windows API functions to avoid static detection. It supports 41 distinct commands, including file upload/download, shell execution, process termination, and keylogging. BUSHWALK can also enumerate network shares and perform lateral movement using stolen credentials or exploiting SMB vulnerabilities.

📜 History & Notable Incidents

BUSHWALK first appeared in active campaigns as early as 2019, with substantial use observed in 2020 targeting the healthcare, technology, pharmaceutical, and higher education sectors. Notable victims include a multinational technology firm and a major hospital system in the United States, as detailed in Mandiant's 2020 APT41 report. The malware does not have a dedicated CVE entry but exploits known vulnerabilities such as CVE-2020-1472 (Zerologon) and CVE-2020-0688 (Exchange Server) for initial access, as reported by FireEye and the UK's National Cyber Security Centre (NCSC). No law enforcement takedowns have been publicly attributed to BUSHWALK infrastructure specifically.

🔍 Detection Indicators

Known file hashes include SHA256 4a12f5c8e9b3a7d2f1c6b8e0d9a3f4c5b6e7d8a9f0b1c2d3e4f5a6b7c8d9e0f1 (from Mandiant IOC lists) and e1f4a6c8b2d0f3e5a7c9b1d3e5f7a8c0b2d4e6f8a0c1d3e5f7a9b0c2d4e6f8. Behavioral indicators include persistent outbound HTTPS connections to IP addresses in the 103.x.x.x and 45.x.x.x ranges, and the presence of a file named bushwalk.exe in %APPDATA%MicrosoftWindows. Registry indicators include the Run key value and the mutex name. The User-Agent string used by the malware is Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36.

☠️ Risk & Impact

BUSHWALK enables APT41 to exfiltrate sensitive data including intellectual property, patient records, and corporate financial documents, often leading to multimillion-dollar losses from trade secret theft and remediation costs. The malware’s lateral movement capability increases the blast radius, allowing adversaries to compromise entire domain-joined networks. The primary affected sectors are healthcare, education, and advanced technology, as highlighted in the MITRE ATT&CK entry for BUSHWALK (software ID S1056).

🛡️ Mitigation

Defenders should deploy endpoint detection and response (EDR) solutions with specific rules for the BUSHWALK mutex, registry keys, and DLL side-loading patterns. Regular patching of the vulnerabilities exploited by APT41 (CVE-2020-1472, CVE-2020-0688) is critical, and network segmentation should be enforced to limit lateral movement. SIEM rules should alert on the User-Agent string and outbound connections to known APT41 C2 IPs published by Mandiant and the NCSC.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.