Loading threat actor…
BazarLoader, also referred to as Bazar Loader, Bazar Backdoor, and Team9 Backdoor, is a malware family associated with the TrickBot ecosystem and used primarily as an initial-access loader to establish a foothold in enterprise environments. It has been tracked in connection with Team9 development activity and is notable for its use of decentralized .bazar command-and-control infrastructure via EmerDNS/OpenNIC, a design choice that complicates disruption and takedown efforts. Operationally, BazarLoader functions as a staged loader and backdoor. Observed samples unpack secondary payloads and inject code into other processes, indicating post-compromise execution chaining and defense-evasion tradecraft. The malware has used both hard-coded command-and-control domains and a domain generation algorithm that produces .bazar domains on a recurring schedule. Public analysis of this DGA showed a constrained generation scheme with a limited candidate space and date-derived seeding logic, enabling the malware to rotate through algorithmically generated infrastructure over time. The malware also obfuscates command-and-control resolution data by decrypting DNS-derived address information before use. The available reporting ties Team9 to the development cycles of Bazar malware, including operational loader variants, multiple backdoor development versions, and operational backdoor samples. High-confidence facts support Team9 as a malware-development designation linked to Bazar rather than a fully profiled standalone intrusion set with clearly established geography, victimology, or strategic sponsorship. Based on the supplied evidence, BazarLoader is best characterized as a TrickBot-associated initial-access and backdoor capability used for enterprise compromise, with process injection and evasive infrastructure management as defining features.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
2 malware families attributed to this actor across reporting.
34 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Associated with BazarLoader/Bazar Backdoor activity used to gain a foothold in compromised enterprise networks, including use of algorithmically generated .bazar C2 domains.
The content focuses on Team9’s development cycles associated with Bazar infrastructure and malware development, including operational loaders, backdoor development versions, operational backdoors, and domains/IPs serving Bazar loader files.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.