{"id":1958,"date":"2021-04-08T14:40:17","date_gmt":"2021-04-08T18:40:17","guid":{"rendered":"https:\/\/cyburityllc.com\/?p=1958"},"modified":"2022-02-27T20:28:17","modified_gmt":"2022-02-28T01:28:17","slug":"bazarloader-used-to-deploy-ryuk-ransomware-on-high-value-targets","status":"publish","type":"post","link":"https:\/\/dialer.one\/index.php\/bazarloader-used-to-deploy-ryuk-ransomware-on-high-value-targets\/","title":{"rendered":"BazarLoader used to deploy Ryuk ransomware on high-value targets"},"content":{"rendered":"\n

BazarLoader used to deploy Ryuk ransomware on high-value targets<\/h1>\n\n\n\n
\"Trojan<\/figure><\/div>\n\n\n\n

The TrickBot gang operators are increasingly targeting high-value targets with the new stealthy BazarLoader trojan before deploying the Ryuk ransomware.<\/p>\n\n\n\n

For years, the TrickBot gang has been using their trojan to compromise enterprise networks by downloading different software modules used for specific behavior such as stealing passwords<\/a>, spreading to other machines<\/a>, or even stealing a domain’s Active Directory database<\/a>.<\/p>\n\n\n\n

As these modules have become heavily analyzed over time, security solutions have become better at detecting these modules before being utilized.<\/p>\n\n\n\n

From TrickBot to BazarLoader<\/h2>\n\n\n\n

In April 2020, bleepingcomputer reported<\/a> that the TrickBot gang had started to use a new BazarLoader\/BazarBackdoor infection in phishing attacks.<\/p>\n\n\n\n

In a new report, Advanced Intel<\/a> security researchers explain<\/a> that instead of burning victims with the highly-detected TrickBot trojan, threat actors now favor BazarBackdoor as their tool of choice for high-value enterprise targets.<\/p>\n\n\n\n

“BazarBackdoor remains the covert malware relying upon minimal functionality while on the host producing high-value long-term infections due to its simplicity and external operation dependency to exploit more information later.”<\/p>\n\n\n\n

“In other words, the BazarBackdoor \u201cblending-in\u201c simplicity and obfuscation layer allows the payload to be a better choice for high-value targets,” Kremez told BleepingComputer in a conversation about their report.<\/p>\n\n\n\n

A BazarLoader compromise starts with a targeted phishing attack, as shown by a phishing email received by BleepingComputer in April.<\/p>\n\n\n\n

\"BazarLoader
BazarLoader phishing attack<\/strong><\/figcaption><\/figure><\/div>\n\n\n\n

After infecting a computer, BazarLoader will use process hollowing to inject the BazarBackdoor component into legitimate Windows processes such as cmd.exe, explorer.exe, and svchost.exe. A scheduled task is created to load BazarLoader every time a user logs into the system.<\/p>\n\n\n\n

\"BazarLoader
BazarLoader scheduled task<\/strong><\/figcaption><\/figure><\/div>\n\n\n\n

Eventually, BazarBackdoor will deploy a Cobalt Strike beacon, which provides remote access to threat actors who install post-exploitation tools such as BloodHound and Lasagne for mapping a Windows domain and extracting credentials.<\/p>\n\n\n\n

Ultimately, the attack leads to threat actors deploying Ryuk ransomware on the entire network and demand massive ransoms.<\/p>\n\n\n\n

\"BazarBackdoor
BazarBackdoor attack flow<\/strong>
Source: Advanced Intel<\/figcaption><\/figure><\/div>\n\n\n\n

Even with this increase in utilization, as BazarBackdoor requires a more significant amount of human-operation, Kremez believes that BazarLoader will be reserved for select targets.<\/p>\n\n\n\n

“The downside of hunting with BazarBackdoor is that it requires an expensive exploitation operation to pivot from the infections,” Kremez explained.<\/p>\n\n\n\n

For mass-distribution, we should continue to see TrickBot utilized for network compromise.<\/p>\n\n\n\n

\n\n\n\n

Check out our FREE security audit<\/a> to see if you are a victim.<\/p>\n","protected":false},"excerpt":{"rendered":"

BazarLoader used to deploy Ryuk ransomware on high-value targets The TrickBot gang operators are increasingly targeting high-value targets with the new stealthy BazarLoader trojan before deploying the Ryuk ransomware. For years, the TrickBot gang has been using their trojan to compromise enterprise networks by downloading different software modules used for specific behavior such as stealing passwords, spreading […]<\/p>\n","protected":false},"author":1,"featured_media":1959,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"content-type":"","_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[],"tags":[],"class_list":["post-1958","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"https:\/\/dialer.one\/wp-content\/uploads\/2021\/04\/trojan-horse-chip.jpg","jetpack-related-posts":[{"id":1949,"url":"https:\/\/dialer.one\/index.php\/what-is-bazarcall-malware\/","url_meta":{"origin":1958,"position":0},"title":"What is BazarCall malware?","author":"carpenox","date":"April 8, 2021","format":false,"excerpt":"What is BazarCall malware? Answer: Malware targeting VoIP servers. Read on. For the past two months, security researchers have been waging an online battle against a new 'BazarCall' malware that uses call centers to distribute some of the most damaging Windows malware. The new malware was discovered being distributed by\u2026","rel":"","context":"Similar post","block_context":{"text":"Similar post","link":""},"img":{"alt_text":"BazarCall","src":"https:\/\/i0.wp.com\/dialer.one\/wp-content\/uploads\/2021\/04\/bazarcall-spam-example.jpg?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/dialer.one\/wp-content\/uploads\/2021\/04\/bazarcall-spam-example.jpg?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/dialer.one\/wp-content\/uploads\/2021\/04\/bazarcall-spam-example.jpg?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/dialer.one\/wp-content\/uploads\/2021\/04\/bazarcall-spam-example.jpg?resize=700%2C400&ssl=1 2x, https:\/\/i0.wp.com\/dialer.one\/wp-content\/uploads\/2021\/04\/bazarcall-spam-example.jpg?resize=1050%2C600&ssl=1 3x"},"classes":[]},{"id":2951,"url":"https:\/\/dialer.one\/index.php\/how-to-fix-the-perl-repo-for-vicibox-10leap-15-3\/","url_meta":{"origin":1958,"position":1},"title":"How To – Fix the Perl repo for ViciBox 10(Leap 15.3)","author":"carpenox","date":"May 30, 2023","format":false,"excerpt":"How To - Fix the Perl repo for ViciBox 10(Leap 15.3) If you've tried to update your ViciBox 10 system you'll see that the Perl repo gives an error and you can't update from that repo any longer. The reason for this is because Leap 15.3 has gone end of\u2026","rel":"","context":"In "Vicidial"","block_context":{"text":"Vicidial","link":"https:\/\/dialer.one\/index.php\/category\/vicidial\/"},"img":{"alt_text":"Repository 'openSUSE-Leap-15.2-PHP-Applications' is invalid.","src":"https:\/\/i0.wp.com\/dialer.one\/wp-content\/uploads\/2022\/03\/image-15.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/dialer.one\/wp-content\/uploads\/2022\/03\/image-15.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/dialer.one\/wp-content\/uploads\/2022\/03\/image-15.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/dialer.one\/wp-content\/uploads\/2022\/03\/image-15.png?resize=700%2C400&ssl=1 2x, https:\/\/i0.wp.com\/dialer.one\/wp-content\/uploads\/2022\/03\/image-15.png?resize=1050%2C600&ssl=1 3x"},"classes":[]},{"id":2673,"url":"https:\/\/dialer.one\/index.php\/how-to-use-firewalld-via-command-line\/","url_meta":{"origin":1958,"position":2},"title":"How to – Use Firewalld via command line","author":"carpenox","date":"August 31, 2022","format":false,"excerpt":"Hopefully this will help a lot of you that end up just not using a firewall at all because it intimidates you not knowing how to use it correctly. Well, I've just eliminated that excuse, so now I want to see more of you securing your servers and dialer systems.\u2026","rel":"","context":"In "CyburDial"","block_context":{"text":"CyburDial","link":"https:\/\/dialer.one\/index.php\/category\/cyburdial\/"},"img":{"alt_text":"Robots trying to hack in","src":"https:\/\/i0.wp.com\/dialer.one\/wp-content\/uploads\/2022\/08\/robot-hackers-tryin-to-break-into-servers-2.jpg?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/dialer.one\/wp-content\/uploads\/2022\/08\/robot-hackers-tryin-to-break-into-servers-2.jpg?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/dialer.one\/wp-content\/uploads\/2022\/08\/robot-hackers-tryin-to-break-into-servers-2.jpg?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/dialer.one\/wp-content\/uploads\/2022\/08\/robot-hackers-tryin-to-break-into-servers-2.jpg?resize=700%2C400&ssl=1 2x"},"classes":[]},{"id":1977,"url":"https:\/\/dialer.one\/index.php\/how-to-secure-vicidial-correctly-part-1\/","url_meta":{"origin":1958,"position":3},"title":"How to – Secure Vicidial, correctly. Part 1","author":"carpenox","date":"April 10, 2021","format":false,"excerpt":"How to - Secure Vicidial, correctly. Part 1 This article will show you how to secure Vicidial server correctly. This is definitely one of the topics, that I am asked about the most, so with that being said, this will be a multipart series with different \"layers\" of security from\u2026","rel":"","context":"In "Vicidial"","block_context":{"text":"Vicidial","link":"https:\/\/dialer.one\/index.php\/category\/vicidial\/"},"img":{"alt_text":"secure vicidial","src":"https:\/\/i0.wp.com\/dialer.one\/wp-content\/uploads\/2021\/04\/image-13.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/dialer.one\/wp-content\/uploads\/2021\/04\/image-13.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/dialer.one\/wp-content\/uploads\/2021\/04\/image-13.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/dialer.one\/wp-content\/uploads\/2021\/04\/image-13.png?resize=700%2C400&ssl=1 2x, https:\/\/i0.wp.com\/dialer.one\/wp-content\/uploads\/2021\/04\/image-13.png?resize=1050%2C600&ssl=1 3x"},"classes":[]},{"id":2378,"url":"https:\/\/dialer.one\/index.php\/table-of-contents\/","url_meta":{"origin":1958,"position":4},"title":"Table of Contents – Knowledge Base","author":"carpenox","date":"March 7, 2022","format":false,"excerpt":"Welcome to my blog, some of you may know me from the ViciDial forums, I am carpenox and I am here to share my knowledge with everyone, for free!","rel":"","context":"In "Vicidial"","block_context":{"text":"Vicidial","link":"https:\/\/dialer.one\/index.php\/category\/vicidial\/"},"img":{"alt_text":"CyburDial","src":"https:\/\/i0.wp.com\/dialer.one\/wp-content\/uploads\/2022\/02\/image.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/dialer.one\/wp-content\/uploads\/2022\/02\/image.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/dialer.one\/wp-content\/uploads\/2022\/02\/image.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/dialer.one\/wp-content\/uploads\/2022\/02\/image.png?resize=700%2C400&ssl=1 2x, https:\/\/i0.wp.com\/dialer.one\/wp-content\/uploads\/2022\/02\/image.png?resize=1050%2C600&ssl=1 3x"},"classes":[]},{"id":1714,"url":"https:\/\/dialer.one\/index.php\/cyburity-llc-brings-you-cyburdial-a-cloud-based-zero-trust-predictive-dialer\/","url_meta":{"origin":1958,"position":5},"title":"CyburDial -:- A Cloud Based ‘Zero Trust’ Predictive Dialer","author":"carpenox","date":"March 22, 2021","format":false,"excerpt":"CyburDial -:- A Cloud Based 'Zero Trust' Predictive Dialer In this emerging world of ransomware, malware, and hacks such as SolarWinds becoming our everyday reality, how concerned are you with data security? How important is your privacy and sense of security? WCW I(World Cyber War) is right around the corner\u2026","rel":"","context":"In "CyburDial"","block_context":{"text":"CyburDial","link":"https:\/\/dialer.one\/index.php\/category\/cyburdial\/"},"img":{"alt_text":"CyburDial","src":"https:\/\/i0.wp.com\/dialer.one\/wp-content\/uploads\/2021\/03\/newwelcome.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/dialer.one\/wp-content\/uploads\/2021\/03\/newwelcome.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/dialer.one\/wp-content\/uploads\/2021\/03\/newwelcome.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/dialer.one\/wp-content\/uploads\/2021\/03\/newwelcome.png?resize=700%2C400&ssl=1 2x, https:\/\/i0.wp.com\/dialer.one\/wp-content\/uploads\/2021\/03\/newwelcome.png?resize=1050%2C600&ssl=1 3x"},"classes":[]}],"jetpack_likes_enabled":true,"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/dialer.one\/index.php\/wp-json\/wp\/v2\/posts\/1958","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dialer.one\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dialer.one\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dialer.one\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/dialer.one\/index.php\/wp-json\/wp\/v2\/comments?post=1958"}],"version-history":[{"count":0,"href":"https:\/\/dialer.one\/index.php\/wp-json\/wp\/v2\/posts\/1958\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/dialer.one\/index.php\/wp-json\/wp\/v2\/media\/1959"}],"wp:attachment":[{"href":"https:\/\/dialer.one\/index.php\/wp-json\/wp\/v2\/media?parent=1958"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dialer.one\/index.php\/wp-json\/wp\/v2\/categories?post=1958"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dialer.one\/index.php\/wp-json\/wp\/v2\/tags?post=1958"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}