BazarBackdoor
BazarBackdoor is a Windows backdoor malware family also referred to in the provided content alongside BazarLoader, with some reporting using the names interchangeably for related payloads. It is associated with the TrickBot/Conti cybercrime ecosystem and has been tracked by Mandiant in activity involving UNC2053. The content states that Conti evolved into a broader cybercrime syndicate and assumed control over development of multiple malware operations including TrickBot and BazarBackdoor, and that leaked Conti materials included the BazarBackdoor API.
Observed delivery includes malicious email campaigns and abuse of the Windows 10 App Installer mechanism via ms-appinstaller links. In the Sophos-reported campaign, personalized complaint-themed phishing emails led victims to a malicious .appinstaller file and .appxbundle hosted on Microsoft cloud storage, presenting a fake Adobe-branded installer. The installed payload chain used SecurityFix.exe to download a DLL, execute it via regsvr32.exe, respawn through child processes with delays, and ultimately inject into a headless msedge.exe process.
Capabilities directly described in the content include HTTPS-based command-and-control using cookie values in GET or POST headers to send data, receipt of commands through Set-Cookie response headers, noisy traffic generation to unrelated websites, and host profiling through PowerShell and native commands. The malware was observed collecting system information including hard disks, processor, motherboard, RAM, network environment, and the victim’s public-facing IP address. Reported URI paths associated with this activity included /segment/billion, /recite/drink, /mission/revolt, /discreet/marble, and /note/actual.
The malware is linked in the content to ransomware operations. UNC2053 distributed BazarLoader via malicious email campaigns, and those loaders downloaded BazarBackdoor that subsequently delivered FIN12 Cobalt Strike BEACON payloads. The content also states BazarBackdoor can enable distribution of Ryuk ransomware, was recently sighted in ransomware-as-a-service campaigns, and rose in prevalence as TrickBot activity declined. Additional reporting cited code similarities between TrickBot and BazarBackdoor, and one source states TrickBot was officially discontinued in favor of improved malware such as BazarBackdoor.
Targeting described in the content is broad, including people around the world in the App Installer campaign, and downstream ransomware activity affecting large organizations, especially in North America, with notable healthcare targeting in FIN12- and Conti-linked operations. A related Elastic report also notes ZenPak as associated with the Bazar malware family and references BazarBackdoor’s history in ransomware-as-a-service campaigns.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Update (2021-01-15): Microsoft Security Response has issued CVE-2021-43890 in reference to the vulnerability in the App installer process described below. The bug was fixed in the January, 2022 Patch Tuesday release. | The payloads, belonging to a malware family variously known as BazarBackdoor and BazarLoader, were delivered by abusing a novel mechanism... The malware that eventually was installed is BazarBackdoor.
"Privileges have been escalated using Mimikatz, Rubeus4 [13], or by exploiting a Zerologon vulnerability (CVE-2020-1472) [26]."
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Techniques & procedures
20 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
2 techniques
Initial Access
Execution
1 technique
Execution
Persistence
1 technique
Persistence
“Bazar activity can be identified by searching the system startup folders and Userinit values under… Winlogon registry key: %APPDATA%\…\Startup\adobe.lnk” / (Ryuk table) “Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder… create a Registry entry…\Run to establish persistence.”
Privilege Escalation
2 techniques
Privilege Escalation
the DLL terminates and an instance of the Edge browser (Chromium version) spawns, with the code injected into a headless instance of msedge.exe.
“Bazar activity can be identified by searching the system startup folders and Userinit values under… Winlogon registry key: %APPDATA%\…\Startup\adobe.lnk” / (Ryuk table) “Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder… create a Registry entry…\Run to establish persistence.”
Stealth
4 techniques
Stealth
the attacker simply added individual display properties for the program’s name (“Adobe PDF Component”), publisher (“Adobe Inc.”), and an Adobe Acrobat logo graphic stored in a subfolder.
the DLL terminates and an instance of the Edge browser (Chromium version) spawns, with the code injected into a headless instance of msedge.exe.
Defense Impairment
1 technique
Defense Impairment
Credential Access
1 technique
Credential Access
Discovery
3 techniques
Discovery
These three queries profiled the hard drive, processor information, and RAM on the system.
Lateral Movement
2 techniques
Lateral Movement
Command and Control
5 techniques
Command and Control
What may be more helpful, though, is the BazarBackdoor APIs and TrickBot command and control server source code that was released, as there is no way to access that info without having access to the threat actor's infrastructure.
Like many other malware, BazarBackdoor (and its related sibling BazarLoader) communicates over HTTPS
These loaders then downloaded a corresponding BAZARBACKDOOR payload that was used to subsequently deliver a FIN12 BEACON payload.
IOCs tracked for this family
4 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A backdoor/loader delivered via malicious App Installer packages that injects into a headless msedge.exe process, beacons to command-and-control over HTTPS using cookie and Set-Cookie headers, and performs host and network profiling via PowerShell and native Windows commands.
Backdoor malware operation referenced as being under Conti syndicate control.
Backdoor family referenced as an association for ZenPak; noted for historical use in ransomware-as-a-service ecosystems.
BazarBackdoor is referenced as part of the leaked Conti materials via its API, indicating a backdoor tool associated with the broader Conti leak context.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.