BoolkaThreat actor
Boolka is a threat actor known for infecting websites with malicious JavaScript scripts for data exfiltration. They have been carrying out opportunistic SQL injection attacks since at least 2022. Boolka has developed a malware delivery platform based on the BeEF framework and has been distributing the BMANAGER trojan.From MISP Galaxy
Last reported 8 months ago, by Group-IB2 reports
ATT&CK techniques
6 of 30 · each with the sentence it comes from- T1001Data Obfuscation
“T1001 – Data Obfuscation”
- T1005Data from Local System
“T1005 – Data from Local System”
- T1041Exfiltration Over C2 Channel
“T1041 – Exfiltration Over C2 Channel”
- T1056Input Capture
“T1056 – Input Capture”
- T1056.001Keylogging
“T1056.001 – Input Capture: Keylogging”
- T1059Command and Scripting Interpreter
“T1059.007 – Command and Scripting Interpreter: JavaScript”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
Shaping Shadows: Breaking Down New ShadowSyndicate Methods and Infrastructure“…icture, because these pieces may lead to a complete breakdown of the threat actor or exploration of new clusters, as was the case in the Boolka research.”
-
Boolka Unveiled: From web attacks to modular malware“Boolka Unveiled: From web attacks to modular malware”
Indicators in its reports
named in the reports above- 1ca4cbac895fc3bd12417b77fc6ed31din 1 report
- 45.182.189[.]109in 1 report
- hxxps://beef.beonlineboo[.]com/hook.jsin 1 report
- beef.beonlineboo[.]comin 1 report
- 1-update-soft[.]comin 1 report
- update-brower[.]comin 1 report
- hxxps://updatebrower[.]com/download/bmbackup.txt;bmbackup;C:Programin 1 report
- updatebrower[.]comin 1 report
- hxxps://updatebrower[.]com/download/bmhook.txt;bmhook;C:Programin 1 report
- hxxps://updatebrower[.]com/download/bmlog.txt;bmlog;C:Programin 1 report
- hxxps://updatebrower[.]com/download/bmreader.txt;bmreader;C:Programin 1 report
- 2f10a81bc5a1aad7…bc6219ea1802in 1 report
- tacke[.]ruin 1 report
- 7266f20123edcb2e…53bff06719e4in 1 report
- 9434e2f277f764bb…68b7e9b4b3a2in 1 report
- b2dbd3187c67883c…e37f5985e367in 1 report
- 94430690ac9516a2…0b5f750685eein 1 report
- 227b8233071da4d3…23afb798375ain 1 report
- 194.165.16[.]68in 1 report
- 141.98.81[.]23in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.