B aza (BazarLoader & BazarBackdoor) has been attributed to the organized cybercrime group behind Trickbot by multiple security vendors over the past year.
BazarBackdoor
BazarBackdoor is a Windows backdoor associated with the TrickBot ecosystem, commonly attributed to ITG23/Wizard Spider.
BazarBackdoor
Family profile
BazarBackdoor is a Windows backdoor associated with the TrickBot ecosystem, commonly attributed to ITG23/Wizard Spider. First identified in 2020, it was frequently deployed by BazarLoader and used to establish remote access to enterprise environments for follow-on intrusion activity, including Cobalt Strike deployment and Conti or Ryuk ransomware operations. The names BazarBackdoor and BazarLoader have at times been used interchangeably, although BazarLoader is more specifically characterized as the loader that retrieves the backdoor.
BazarBackdoor has been distributed through phishing campaigns using social-engineering themes such as employment termination, customer complaints, invoices, and payment notices. Delivery chains have used malicious documents, archives, CSV files abusing Excel DDE, JavaScript, and links through document-hosting services. It can communicate with command-and-control infrastructure, retrieve additional payloads, and execute filelessly through process hollowing and process doppelgänging. Observed variants established persistence using scheduled tasks and used decentralized DNS/DGA-based resolution for command-and-control communications. Access provided by BazarBackdoor has supported reconnaissance, credential theft, lateral movement, data theft, and ransomware deployment against corporate networks.
Capabilities
- Defense Evasion
- Initial Access
- Lateral Movement
- Persistence
- Post Exploitation
- Process Injection
Samples
Recent samples
1 sandbox sample in the Derp library, newest 1 shown
Reported operators
Threat actors
5 named in public reportingThe TrickBot Gang is most known for its namesake, the TrickBot banking trojan, but is also behind the development of the BazarBackdoor and Anchor backdoors.
According to a separate report published by Advanced Intelligence (AdvIntel) last week, the Conti ransomware cartel is believed to have acqui-hired several elite developers of TrickBot to retire the malware and switch to upgraded variants such as BazarBackdoor.
In October 2021, the IBM X-Force reported that the threat group ITG23 ... had partnered with Shathak ... to distribute the TrickBot and the BazarBackdoor (also referred to as BazarLoader) malware.
We track the use of BAZARLOADER and BAZARBACKDOOR as UNC2053.
Exploited software
Vulnerabilities linked to BazarBackdoor
2 CVEsMITRE ATT&CK
BazarBackdoor in ATT&CK
43 distinct techniquesTechniques
43 techniques T1568.002 Domain Generation Algorithms T1566.002 Spearphishing Link T1036 Masquerading T1053.005 Scheduled Task T1566 Phishing T1055.012 Process Hollowing T1071 Application Layer Protocol T1055 Process Injection T1219 Remote Access Tools T1486 Data Encrypted for Impact T1105 Ingress Tool Transfer T1018 Remote System Discovery T1559.001 Component Object Model T1547.009 Shortcut Modification T1218.005 Mshta T1218.011 Rundll32 T1204.002 Malicious File T1140 Deobfuscate/Decode Files or Information T1027.007 Dynamic API Resolution T1027 Obfuscated Files or Information T1566.001 Spearphishing Attachment T1047 Windows Management Instrumentation T1620 Reflective Code Loading T1059.001 PowerShell T1482 Domain Trust Discovery T1071.001 Web Protocols T1087 Account Discovery T1587.001 Malware T1218.010 Regsvr32 T1587 Develop Capabilities T1543.003 Windows Service T1568 Dynamic Resolution T1059.005 Visual Basic T1553.002 Code Signing T1497.001 System Checks T1132 Data Encoding T1135 Network Share Discovery T1082 System Information Discovery T1210 Exploitation of Remote Services T1021 Remote Services T1048 Exfiltration Over Alternative Protocol T1003 OS Credential Dumping T1547.001 Registry Run Keys / Startup Folder