BuhtrapMalware
- ratopak
Last reported 6 years ago, by Group-IB5 reports
ATT&CK techniques
1 technique · each with the sentence it comes from- T1684Social Engineering
“…e regular personnel trainings, which should include not only training sessions on issues related to targeted attacks, phishing and social engineering, but also “combat training”: banks should simulate targeted attacks or phishing emails from time to time.”
What the reports say
5 reports, newest first · the exact sentence from each-
Group-IB unveils its Graph“For example, on 11 July, Eset released a report about Buhtrap using a zero-day exploit for cyberespionage.”
-
Silence: Moving into the Darkside“Financially motivated APT groups which focus efforts on targeted attacks on the financial sector such as — Anunak, Corkow, Buhtrap — usually managed botnets using developed or modified banking Trojans.”
-
Cobalt Renaissance“This attributed the appearance of the Cobalt group with the termination of another infamous gang – Buhtrap.”
-
Secrets of Cobalt“The basic principles of targeted attacks on financial institutions have not changed since 2013 when the Anunak, Corkow, Buhtrap, and Lurk groups began conducting the first attacks on Russian banks.”
-
Targeted attacks on banks“…nd Corkow, which conducted targeted attacks, whereas in 2015 there were three (Anunak, Corkow and Andromeda), and in 2016 four of them (Buhtrap, Lurk, Cobalt and MoneyTaker).”
Indicators in its reports
named in the reports above- 11.11.11[.]11in 1 report
- 22.22.22[.]22in 1 report
- 33.33.33[.]33in 1 report
- example[.]ruin 1 report
- secure-telemetry[.]netin 1 report
- ukrfreshnews[.]comin 1 report
- unian-search[.]comin 1 report
- vesti-world[.]infoin 1 report
- runewsmeta[.]comin 1 report
- foxnewsmeta[.]bizin 1 report
- sobesednik-meta[.]infoin 1 report
- rian-ua[.]netin 1 report
- themcx[.]coin 1 report
- phone-lookup[.]xyzin 1 report
- coinkeeper[.]ccin 1 report
- caller-record[.]sitein 1 report
- mcxwallet[.]coin 1 report
- phone-records[.]spacein 1 report
- btcnoise[.]comin 1 report
- fone-uncover[.]xyzin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.