⚠️ Overview

BELLHOP is a backdoor malware first documented by MITRE ATT&CK as S0470, attributed to the Iranian-linked threat group APT33 (also known as Elfin, Magnallium). It was first observed in the wild around 2013, with public analysis by FireEye and Microsoft in 2017–2018. BELLHOP functions primarily as a persistent remote access tool (RAT) that enables command execution and file transfer, categorizing it under backdoor and espionage malware.

🔧 Technical Capabilities

BELLHOP is written in C++ and communicates with its command-and-control (C2) infrastructure over HTTP using a custom, encrypted protocol. It establishes persistence by creating a scheduled task named "bellhop" or modifying the Windows Registry key HKCUSoftwareMicrosoftWindowsCurrentVersionRun with a value pointing to the malware binary. Propagation is achieved via spear-phishing emails containing malicious attachments (e.g., RAR archives with embedded executables), often dropped by a separate loader such as DROPSHOT (MITRE S0416). Evasion techniques include checking for sandbox environments by verifying system uptime and processor count, and using a mutex named "bellhop" to prevent multiple instances. The backdoor supports up to 20 commands, including file enumeration, upload/download, process execution, and registry manipulation. It can also proxy network traffic to additional C2 nodes, acting as a relay within a victim network. C2 communication uses HTTP POST requests with encrypted data fields, often disguising traffic as legitimate web traffic to avoid detection.

📜 History & Notable Incidents

First identified in 2013, BELLHOP was publicly detailed in a 2017 FireEye report analyzing APT33’s operations against aviation, petrochemical, and defense sectors in the Middle East. A 2018 campaign targeted a Saudi Arabian organization using BELLHOP alongside the Shamoon wiper (MITRE S0143) for destructive attacks. No specific CVE is directly associated with BELLHOP itself, but it has been delivered via exploits for Microsoft Office vulnerabilities (e.g., CVE-2017-8570, CVE-2018-8174) in spear-phishing emails. Law enforcement actions have not been publicly linked to BELLHOP due to its state-sponsored operational security.

🔍 Detection Indicators

Known static indicators include the mutex name bellhop (case-sensitive) and scheduled task names like "BellhopTask" or "BellhopUpdates". Behavioral signatures include HTTP POST requests to /images/ or /upload/ paths with Base64-encoded payloads, User-Agent strings mimicking standard browsers (e.g., Mozilla/5.0 (Windows NT 6.1; rv:60.0) Gecko/20100101 Firefox/60.0). Registry key modifications under HKCUSoftwareMicrosoftWindowsCurrentVersionRun with values containing random alphanumeric strings (e.g., svchost.exe or rundll32.exe). File hashes are not publicly cataloged en masse, but samples analyzed by FireEye in 2018 have SHA256 hashes that can be cross-referenced via VirusTotal and MITRE ATT&CK.

☠️ Risk & Impact

BELLHOP primarily enables long-term espionage, allowing APT33 to exfiltrate sensitive documents, intellectual property, and network reconnaissance data from compromised networks. The malware has been observed in sectors critical to energy, aerospace, and defense, with financial losses stemming from data breaches and operational disruptions. Secondary impacts include enabling destructive attacks (e.g., Shamoon wiper) that destroy system data, causing extended downtime and recovery costs.

🛡️ Mitigation

Defenders should implement email filtering to block spear-phishing attachments, enable application whitelisting to prevent unauthorized executables, and deploy endpoint detection and response (EDR) rules for scheduled task creation and mutex "bellhop". Network monitoring for beaconing HTTP POST traffic to unknown domains and periodic threat hunting using the YARA rule published in the FireEye BELLHOP analysis (2018) are recommended. Regular patching of Office vulnerabilities (CVE-2017-8570, CVE-2018-8174) reduces initial access vectors.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.