Betruger

Betruger is a backdoor malware associated with ransomware operations, particularly RansomHub affiliates. Reporting describes it as a custom backdoor that is rarely seen in ransomware attacks and as malware used in support of ransomware campaigns. In a September 2024 intrusion analyzed by The DFIR Report, the threat actor initially deployed SectopRAT and then, six days after initial access, used it to deploy Betruger as a second backdoor while conducting additional reconnaissance. Betruger was described as consolidating multiple pre-ransomware capabilities into a single tool, including screenshot capture, keylogging, privilege escalation, network discovery, and credential theft. The same intrusion involved broader post-compromise activity such as use of SystemBC, AdFind, SharpHound, SoftPerfect NetScan, PsExec, DCSync, Windows Defender tampering, process injection, timestomping, and data exfiltration via FTP, but only Betruger’s direct capabilities can be attributed to the malware itself with high confidence. Content also links Betruger to RansomHub and notes its emergence alongside other novel malware families in 2025 threat reporting. No specific infection vector, platform-specific persistence mechanism, or standalone IOC unique to Betruger is provided in the source content.