BuhTrap

Buhtrap is a Russian-speaking cybercriminal group and malware ecosystem historically associated with targeted intrusions against banks, financial institutions, and businesses in Russia. It emerged as one of the notable groups involved in early targeted attacks on Russian banks, particularly operations against core banking systems, and has been discussed alongside other financially motivated actors such as Anunak, Corkow, Lurk, and Cobalt. Buhtrap is also the name used for the group’s backdoor and related tooling, which has contributed to some reporting ambiguity between the actor and malware family. Buhtrap’s early operations were primarily financially motivated and relied heavily on spearphishing and malicious documents to compromise victims. The group commonly used decoy content tailored to the target, including business-themed lures for commercial entities and banking-regulation-themed lures for Russian financial institutions. Its delivery chains frequently used NSIS-based droppers, followed by installation of the main backdoor and supporting modules. Buhtrap has repeatedly used valid code-signing certificates, malicious macros, and DLL side-loading through legitimate applications to evade detection and blend into victim environments. From late 2015 onward, Buhtrap was observed expanding beyond bank-focused crime into espionage-oriented targeting of governmental institutions in Eastern Europe and Central Asia. Reporting has assessed with high confidence that the operators behind the earlier financially motivated campaigns were also involved in these later government-focused intrusions. In those campaigns, the group retained much of its established tradecraft rather than adopting a wholly new toolset. Government-themed decoys, including Ukrainian-language lures impersonating official institutions, were used to target public-sector personnel. Buhtrap has demonstrated mature post-compromise capability. Documented behaviors include persistence establishment, credential theft through a password-harvesting grabber module targeting browsers and mail clients, privilege escalation using both known and zero-day Windows local privilege escalation exploits, and deployment of additional payloads including Meterpreter. The group has also used firewall-rule modification to facilitate command-and-control communications and has employed DNS tunneling in at least one observed payload chain. Buhtrap is notably associated with use of CVE-2019-1132, a Windows local privilege escalation vulnerability exploited as a zero-day in 2019, marking the first publicly reported zero-day use attributed to the group. Earlier campaigns also used known privilege escalation vulnerabilities such as CVE-2015-2387. Buhtrap sits at the intersection of organized cybercrime and higher-end intrusion tradecraft. Its operations illustrate how financially motivated actors can evolve into espionage-focused targeting while preserving established malware delivery and persistence methods. Separate research has linked exploit developer Volodya, also known as BuggiCorp or Volodimir, to the exploit used in the CVE-2019-1132 activity attributed to Buhtrap, underscoring the group’s access to advanced exploit capability through external suppliers or partnerships.