BONDUPDATER
BONDUPDATER is a PowerShell-based downloader/remote-access trojan associated with the Iranian threat group OilRig (APT34). Reporting in the provided content places its use as early as mid-2017, including campaigns against Middle Eastern government and other regional targets, and describes it as part of OilRig’s broader arsenal alongside tools such as Helminth, ISMAgent, LIONTAIL, and TONEDEAF.
The malware is used for sustained access and post-compromise operations. Documented capabilities include command-and-control over DNS, use of a custom domain generation algorithm to generate subdomains for C2 communication, downloading and uploading files, and reading batch commands from a file sent by the C2 server and executing them via cmd.exe. The content also states that different versions of BONDUPDATER function as a remote-access trojan/downloader and that OilRig used it in operations involving credential theft, lateral movement, intelligence collection, malware deployment, and document exfiltration.
BONDUPDATER uses stealth and persistence mechanisms centered on PowerShell. It is described as using PowerShell with -windowstyle hidden to conceal the download window, and it persists via a scheduled task that executes every minute. In one documented infection chain attributed to APT34/OilRig, a malicious RTF exploiting CVE-2017-11882 led to mshta execution, retrieval of additional scripts, and installation of scheduled-task persistence that launched VBS and PowerShell payloads every minute from C:\ProgramData\Windows\Microsoft\java. In that chain, dUpdateCheckers.ps1 was identified as the BONDUPDATER component.
The content specifically notes DNS tunneling behavior. Early variants used DNS A queries via System.Net.Dns GetHostAddresses and created a unique system identifier from the first 12 characters of whoami output, with beacon subdomains ending in B007 plus the C2 domain. Early variants received a filename via an IPv4 answer beginning with 24.125 and used the last digit of the filename to determine whether to execute PowerShell commands directly or write content to .ps1 or .vbs files; IPv4 11.24.237.110 was used as a termination signal. Updated variants could use raw sockets via System.Net.Sockets.UdpClient and both A and TXT records for C2. The updated version could be instructed by IPv4 99.250.250.199 to switch to an alternate TXT-based DNS tunnel, and TXT responses contained control instructions such as N, S, S000s, E, and C to govern filename creation, base64 decoding, writing data, and canceling communications. Separate reporting in the content also states BONDUPDATER can use both A and TXT records within its DNS tunneling protocol.
Observed infection vectors in the provided material include spear-phishing with malicious RTF attachments exploiting CVE-2017-0199 and CVE-2017-11882. The content ties BONDUPDATER to OilRig targeting across sectors including government, financial, energy, chemical, and telecommunications, largely in the Middle East, with one explicit reference to use against a Middle Eastern government. Additional context from leaked OilRig tooling described variants of BondUpdater under the names PoisonFrog and Glimpse.
High-confidence indicators and artifacts directly mentioned in the content include the scheduled task executing every minute; use of -windowstyle hidden; DNS A and TXT record C2; beacon subdomains ending in B007; IPv4 markers 24.125.* for filename delivery, 11.24.237.110 as a termination signal, and 99.250.250.199 to trigger TXT-mode communications; and filenames/paths from one campaign including dUpdateCheckers.ps1, hUpdateCheckers.ps1, GoogleUpdateschecker.vbs, cUpdateCheckers.bat, and C:\ProgramData\Windows\Microsoft\java.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Key TTPs: Persistent access through webshell installation; credential theft enabling lateral movement; intelligence collection on communications and decision-making; malware deployment (BONDUPDATER or TONEDEAF) for sustained access; document exfiltration targeting policy and strategic planning materials.
Techniques & procedures
8 distinct techniques documented for this family, organized by ATT&CK tactic.
Execution
4 techniques“Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.” / “APT29 used scheduler and schtasks to create new tasks on remote host as part of their lateral movement… updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration.”
During the 2022 Ukraine Electric Power Attack, Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.
The content repeatedly describes threat actors and malware using PowerShell scripts/commands for execution, download, staging, reconnaissance, persistence, credential access, lateral movement, and defense evasion; e.g., "Sandworm Team used PowerShell scripts to run a credential harvesting tool in memory to evade defenses."
During the 2016 Ukraine Electric Power Attack, Sandworm Team used the xp_cmdshell command in MS-SQL. During the 2025 Poland Wiper Attacks, the adversaries leveraged PsExec to run cmd.exe commands on multiple victim machines. Numerous malware families and groups are described as using cmd.exe, cmd /c, Windows command shell, or command-line interfaces to execute commands, payloads, reconnaissance, persistence, cleanup, and ransomware actions. | APT1 has used the Windows command shell to execute commands, and batch scripting to automate execution. Blue Mockingbird has used batch script files to automate execution and deployment of payloads. During HomeLand Justice, threat actors used Windows batch files for persistence and execution.
Persistence
2 techniques“Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.” / “APT29 used scheduler and schtasks to create new tasks on remote host as part of their lateral movement… updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration.”
Privilege Escalation
2 techniques“Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.” / “APT29 used scheduler and schtasks to create new tasks on remote host as part of their lateral movement… updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration.”
Stealth
1 techniqueMultiple actors and malware are described as concealing execution by spawning PowerShell/console windows with parameters like "-WindowStyle Hidden" / "-W Hidden" / "ProcessWindowStyle.Hidden" or via APIs such as ShowWindow, CreateNoWindow, and CREATE_NO_WINDOW.
Command and Control
3 techniquesAPT41 has used DGAs to change their C2 servers monthly. Aria-body has the ability to use a DGA for C2 communications. Astaroth has used a DGA in C2 communications. Bazar can implement DGA using the current date as a seed variable.
IOCs tracked for this family
8 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
16 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Malware used by APT34 for sustained access during espionage operations against government, technology, and energy-related targets.
Backdoor malware used by OilRig for persistent access and command and control.
Backdoor that persists through a scheduled task running every minute.
A PowerShell-written malware/backdoor.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.