MITRE ATT&CKsoftware (malware)

S0234 Bandook

Published 2018-10-17 Modified 2025-04-25 Official page ↗
Domain
enterprise
Platforms
Windows
Version
2.0
Created
2018-10-17

Description

Bandook is a commercially available RAT, written in Delphi and C++, that has been available since at least 2007. It has been used against government, financial, energy, healthcare, education, IT, and legal organizations in the US, South America, Europe, and Southeast Asia. Bandook has been used by Dark Caracal, as well as in a separate campaign referred to as "Operation Manul".

Related

Uses · MITRE ATT&CK (26)

  • T1680 Local Storage Discovery technique
  • T1573.001 Symmetric Cryptography sub-technique
  • T1204.002 Malicious File sub-technique
  • T1059.001 PowerShell sub-technique
  • T1059.003 Windows Command Shell sub-technique
  • T1059.005 Visual Basic sub-technique
  • T1059.006 Python sub-technique
  • T1566.001 Spearphishing Attachment sub-technique
  • T1056.001 Keylogging sub-technique
  • T1027.003 Steganography sub-technique
  • T1553.002 Code Signing sub-technique
  • T1070.004 File Deletion sub-technique
  • T1055.012 Process Hollowing sub-technique
  • T1140 Deobfuscate/Decode Files or Information technique
  • T1005 Data from Local System technique
  • T1016 System Network Configuration Discovery technique
  • T1041 Exfiltration Over C2 Channel technique
  • T1059 Command and Scripting Interpreter technique
  • T1083 File and Directory Discovery technique
  • T1095 Non-Application Layer Protocol technique
  • T1105 Ingress Tool Transfer technique
  • T1106 Native API technique
  • T1113 Screen Capture technique
  • T1120 Peripheral Device Discovery technique
  • T1123 Audio Capture technique
  • T1125 Video Capture technique

Referenced by MITRE ATT&CK · uses (1)

  • G0070 Dark Caracal group

References