Loading malware…
Bisonal is a Windows backdoor used in long-running cyberespionage activity, particularly against organizations in East Asia. It has been associated with campaigns targeting government, military, defense, and other institutional victims in countries including South Korea, Japan, and Russia. Public reporting has linked Bisonal activity most notably to Tonto Team, and some reporting has also discussed possible overlaps with APT10-linked operations, though such attribution is not uniformly established.
Bisonal provides remote access and host reconnaissance capabilities. Documented functions include enumerating running processes, collecting basic host metadata such as system time and network configuration, and executing commands such as ipconfig for local discovery. Reported variants can transmit process listings and system information to command-and-control infrastructure, execute files or commands on the infected host, terminate processes or files, and download additional payloads.
The malware uses multiple obfuscation and encryption methods across variants. Observed samples have encoded binary data with Base64, decoded internal strings using XOR and RC4, and protected command-and-control traffic with simple XOR or RC4. These features indicate a focus on lightweight obfuscation and protected operator communications rather than advanced modularity.
Persistence on Windows has been achieved through Registry Run key autostart entries, and some variants have used rundll32.exe as part of their startup execution chain. Bisonal droppers have also created VBScript components during installation and then removed the dropper and script artifacts afterward, combining persistence with basic cleanup and anti-forensic behavior.
Observed delivery in at least some campaigns relied on spearphishing-style lures and weaponized documents or disguised executables. Reporting has also connected Bisonal to Royal Road-related intrusion activity used by China-aligned espionage operators. Overall, Bisonal is best characterized as an espionage backdoor focused on persistent access, host discovery, remote tasking, and follow-on payload delivery against strategically relevant targets.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
6 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Royal Road is a tool that generates RTF files that exploit the Microsoft Office Equation Editor vulnerabilities (CVE-2017-11882, CVE-2018-0798, CVE-2018-0802).
Royal Road is a tool that generates RTF files that exploit the Microsoft Office Equation Editor vulnerabilities (CVE-2017-11882, CVE-2018-0798, CVE-2018-0802).
Royal Road is a tool that generates RTF files that exploit the Microsoft Office Equation Editor vulnerabilities (CVE-2017-11882, CVE-2018-0798, CVE-2018-0802).
ADに対するマルウェアの設置-脆弱性確認- MS17-010の脆弱性の有無を確認している。... “192.168.66.50 is not patched”と出力されている通り、ADはMS17-010のパッチが適用されていないことを表している。
下記が悪用されて、圧縮ファイル内のドロッパーが起動した。⚫CVE-2018-20250: WinRarに存在する任意のパスにファイルを設置される脆弱性
May 2018: a new wave of targeted attacks abusing CVE-2018-8174 (this exploit has been associated with the DarkHotel APT group, as described on Securelist), with diplomatic, defense, manufacturing, military and government targets in Asia and Eastern Europe;
8 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
'APT10 is said to be behind the campaigns' ... 'Code similarity with BISONAL malware (hardcorded version information)'
Bisonal is another example. It is a backdoor. The malware can be split into two components: the main module, communication module... The malware is capable of: Listing and controlling processes, Creating and deleting files, Creating a remote shell, Downloading and executing files.
Operation Bitter Biscuitの特徴 ⚫標的国: 韓国、ロシア、日本 ⚫標的業種: 政府関係、軍事・国防関連企業 (IT企業も攻撃されたという情報有り[4]) ⚫マルウェア: Bisonal
Operation Bitter Biscuitの特徴 ⚫標的国: 韓国、ロシア、日本 ⚫標的業種: 政府関係、軍事・国防関連企業 (IT企業も攻撃されたという情報有り[4]) ⚫マルウェア: Bisonal
Як результат, комп'ютер жертви буде уражено шкідливою програмою Bisonal... Більше того, шкідлива програма Bisonal, як приклад, є інструментом групи TontoTeam (UAC-0018).
24 distinct techniques documented for this family, organized by ATT&CK tactic.
%TEMP% 경로에 생성된 3개의 파일은 각각 아래와 같은 기능을 한다. %TEMP%[랜덤1].vbs : 정상 xlsx 파일을 실행 %TEMP%[랜덤2].vbs : *.scr 파일을 삭제
The content repeatedly describes threat actors and malware using cmd.exe, the Windows command shell, to execute commands, launch payloads, run batch files, and automate actions on compromised hosts.
APT-C-36 has embedded a VBScript within a malicious Word document which is executed upon the document opening.
The content repeatedly describes malware and threat actors establishing persistence by adding values under Registry Run keys such as HKCU\Software\Microsoft\Windows\CurrentVersion\Run and HKLM\Software\Microsoft\Windows\CurrentVersion\Run, and by placing shortcuts or files in Startup folders.
The content repeatedly describes malware and threat actors establishing persistence by adding values under Registry Run keys such as HKCU\Software\Microsoft\Windows\CurrentVersion\Run and HKLM\Software\Microsoft\Windows\CurrentVersion\Run, and by placing shortcuts or files in Startup folders.
유포 파일명은 xlsx 엑셀 또는 ppt 파워포인트 문서 파일로 보이지만, 유니코드 RLO(Right to Left Override) 방식을 이용하여 파일 확장자를 다른 형태로 보이도록 하였다. 실제 악성 파일은 *.scr 파일이다.
The content repeatedly describes malware and threat actors deleting files, directories, droppers, logs, scripts, temporary files, exfiltrated archives, and uninstalling themselves to cover tracks or reduce forensic artifacts.
The content is a long ATT&CK-style listing of malware and threat groups that 'decrypt', 'decode', 'deobfuscate', 'unpack', or 'decompress' payloads, strings, configuration data, shellcode, and files prior to execution or use.
Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations.
AdFind can extract subnet information from Active Directory; actors used ipconfig /all after exploiting a machine; numerous malware and groups used ipconfig, ifconfig, arp, route, netsh, nbtstat, NBTscan, and related APIs to gather IP, MAC, DNS, DHCP, gateway, proxy, domain, ARP cache, routing, and adapter details.
Tasklist can be used to discover processes running on a system. Numerous malware families and threat groups are described as listing running processes, collecting PIDs, checking for specific process names, or enumerating loaded modules.
The content repeatedly describes malware and threat actors collecting OS version, computer name, architecture, CPU, memory, disk, BIOS, language, and other host details; examples include use of commands such as ver, systeminfo, hostname, uname -m, and WMI to gather host information.
The content is a long ATT&CK-style listing of groups and malware that can 'list files and directories,' 'search for files,' 'enumerate drives,' 'gather file metadata,' or 'browse file systems' on compromised hosts.
The content repeatedly describes malware and threat actors collecting the current date, time, or time zone from victim systems, including examples such as "The net time command can be used... to determine the local or remote system time" and commands like "net time \\hostname" and "w32tm /tz".
Many entries describe XOR, XOR/ADD, bitwise NOT and XOR, ROR plus XOR, hexadecimal encoding after encryption, and custom encoding/obfuscation of HTTP traffic or beacons.
The content is a long ATT&CK-style listing showing numerous malware families and threat groups that 'use HTTP,' 'use HTTPS,' 'HTTP POST requests,' 'HTTP GET requests,' or 'HTTP/S' for command and control communications.
The content repeatedly describes malware and threat actors that can "download files from C2," "download additional payloads," "upload and download files," "retrieve payloads from the C2 server," and "copy files to remote machines."
ADVSTORESHELL C2 traffic is encrypted, then encoded with Base64 encoding. APT19 HTTP malware variant used Base64 to encode communications to the C2 server. APT33 has used base64 to encode command and control traffic.
171 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
93 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A modular backdoor/trojan with main and communication modules. It supports process control, file creation/deletion, remote shell access, downloading additional executables, beaconing, and data theft over HTTP-based client/server C2.
A backdoor RAT associated with Chinese threat actors, used as the payload delivered via malicious Office documents. It provides long-term remote access and has evolved with capabilities for file searching and exfiltration, anti-analysis and detection evasion, and generally unrestricted system control.
Previously known malware referenced only as historical context for Tonto Team activity against Russian organizations.
Its dropper creates VBS scripts on victim machines.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.