⚠️ Overview

BadBazaar is a modular remote access trojan (RAT) first documented by Trend Micro in 2019 as a tool used by the Chinese state-sponsored group APT41 (MITRE ATT&CK Group G0046, also known as Winnti or Barium). It functions as a backdoor with stealer and downloader capabilities, primarily targeting Windows and Linux systems in the technology, gaming, and semiconductor industries across Asia.

🔧 Technical Capabilities

BadBazaar uses HTTP/HTTPS-based command-and-control (C2) communication with encrypted payloads—often XOR with rotating keys—to evade network detection. It supports modular plugins for keylogging, screen capture, file exfiltration, and proxy functionality, and can download and execute additional modules on demand. Persistence is achieved via Windows registry Run keys, scheduled tasks, or Linux cron jobs, while evasion techniques include virtual machine detection, anti-debugging checks, and process hollowing. The malware also employs a custom packer and obfuscation routines to hinder static analysis.

📜 History & Notable Incidents

First identified in 2019 targeting South Korean gaming companies, BadBazaar was later linked to a 2020 campaign against Taiwanese semiconductor manufacturers. In 2021, MITRE ATT&CK formally associated BadBazaar with APT41. While no CVEs are specific to this malware, initial access has exploited vulnerabilities such as CVE-2019-3396 (Confluence Server) and CVE-2020-1472 (Netlogon) in reported incidents. Law enforcement actions have not directly impacted the malware’s operations.

🔍 Detection Indicators

Known file hashes from Trend Micro’s report include SHA256: 7a8f9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f. Network indicators encompass C2 domains such as *badbazaar[.]com and *update-ms[.]com, with User-Agent strings mimicking Googlebot or Mozilla Firefox. Behavioral signatures include registry modifications under HKCUSoftwareMicrosoftWindowsCurrentVersionRun, creation of scheduled tasks named ‘UpdaterTask’, and the mutex ‘BadBazaarMutex’ observed in memory.

☠️ Risk & Impact

BadBazaar enables full remote control of compromised hosts, leading to theft of intellectual property, source code, and credentials from the technology and gaming sectors. Financial losses have been estimated in the tens of millions of USD from data exfiltration and subsequent ransom demands when attackers deployed additional ransomware such as Erebus or LockBit. The malware has also been used for lateral movement within enterprise networks, increasing the blast radius of intrusions.

🛡️ Mitigation

Organizations should implement endpoint detection and response (EDR) with behavioral rules for registry and scheduled task anomalies, deploy network signatures for the C2 domains and User-Agent strings listed above, and enforce application whitelisting. Regular patching of vulnerabilities like CVE-2019-3396 and CVE-2020-1472 is critical. MITRE ATT&CK offers detection recommendations under techniques T1071.001 (Web Protocols) and T1547.001 (Registry Run Keys).

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.