MITRE ATT&CKsoftware (malware)

S0360 BONDUPDATER

Published 2019-02-18 Modified 2025-04-25 Official page ↗

Domain: enterprise
Platforms: Windows
Version: 1.2
Created: 2019-02-18

Description

BONDUPDATER is a PowerShell backdoor used by OilRig. It was first observed in November 2017 during targeting of a Middle Eastern government organization, and an updated version was observed in August 2018 being used to target a government organization with spearphishing emails.

Uses · MITRE ATT&CK (7)

T1071.004 DNS sub-technique
T1564.003 Hidden Window sub-technique
T1568.002 Domain Generation Algorithms sub-technique
T1059.001 PowerShell sub-technique
T1059.003 Windows Command Shell sub-technique
T1053.005 Scheduled Task sub-technique
T1105 Ingress Tool Transfer technique

Referenced by MITRE ATT&CK · uses (1)

G0049 OilRig group

References

https://www.fireeye.com/blog/threat-research/2017/12/targeted-attack-in-middle-east-by-apt34.html FireEye APT34 Dec 2017
https://unit42.paloaltonetworks.com/unit42-oilrig-uses-updated-bondupdater-target-middle-eastern-government/ Palo Alto OilRig Sep 2018

S0360 BONDUPDATER

Description

Related

Uses · MITRE ATT&CK (7)

Referenced by MITRE ATT&CK · uses (1)

References