Buer

Buer is a malware loader used to gain an initial foothold in victim environments and to deliver follow-on payloads. In the provided content, it is explicitly referenced as a loader frequently paired with later-stage malware such as SystemBC, and as part of intrusion chains that ultimately led to Ryuk ransomware deployment. One cited example states that in September 2020, Buer Loader was used to gain a foothold in an intrusion where Ryuk was deployed. The content also places Buer alongside other malware families in in-memory dropper activity and notes that Conti reverse engineers analyzed the Buer loader as part of their malware development efforts. High-confidence details in the content support Buer’s role as an initial-access malware family associated with ransomware intrusion ecosystems, particularly those involving Ryuk and post-compromise tooling such as SystemBC. No specific indicators of compromise, persistence mechanisms, or platform details beyond its role as a loader are directly provided in the content.