ctrlINT What the industry said about every indicator, with the quote

KorliaMalware

  • Bisonal

Bisonal is a remote access tool (RAT) that has been used by Tonto Team against public and private sector organizations in Russia, South Korea, and Japan since at least December 2010.From MITRE ATT&CK

Last reported 3 years ago, by Group-IB1 report

ATT&CK techniques

6 of 21 · each with the sentence it comes from
  1. T1001Data Obfuscation

    “T1001 Data Obfuscation”

    Group-IBVendor
  2. T1016System Network Configuration Discovery

    “T1016 System Network Configuration Discovery”

    Group-IBVendor
  3. T1027Obfuscated Files or Information

    “T1027 Obfuscated Files or Information”

    Group-IBVendor
  4. T1033System Owner/User Discovery

    “T1033 System Owner/User Discovery”

    Group-IBVendor
  5. T1041Exfiltration Over C2 Channel

    “T1041 Exfiltration Over C2 Channel”

    Group-IBVendor
  6. T1057Process Discovery

    “T1057 Process Discovery”

    Group-IBVendor

What the reports say

1 report, newest first · the exact sentence from each

  1. “…have found traces of communication with the C2 server offices-update.com, which was also mentioned by IZ:SOC in connection with another Bisonal malware sample.”

    Group-IBVendor
    Nice Try Tonto Team

Indicators in its reports

named in the reports above
Copy these 20 indicators · defanged

Thanks — we review every report.

Report a wrong match
What is wrong with Korlia here?
No account needed. We do not store your IP address.