⚠️ Overview

Bofamet is a .NET-based remote access trojan (RAT) first identified in July 2021 by researchers tracking the Spanish-speaking threat group Blind Eagle (also tracked as APT-C-36). It is used primarily for targeted espionage against government, energy, and financial institutions in Latin America, with a heavy focus on Colombia. The malware is delivered via spear-phishing emails containing weaponized Microsoft Office documents that exploit known remote code execution vulnerabilities such as CVE-2017-11882.

🔧 Technical Capabilities

Bofamet provides comprehensive surveillance capabilities including keylogging, screenshot capture, clipboard theft, and file exfiltration over encrypted HTTP C2 channels. The malware employs obfuscated .NET assemblies and anti-analysis techniques such as API hooking and debugger detection to evade security tools. Persistence is achieved through scheduled tasks or registry Run keys under HKCUSoftwareMicrosoftWindowsCurrentVersionRun. It collects extensive system information including installed software, process listings, and network configuration, then exfiltrates data via POST requests to attacker-controlled servers. The C2 communication can be encrypted using custom XOR or TLS, as noted in multiple vendor analyses. Bofamet does not self-propagate; its spread is limited to the initial infection vector of malicious email attachments.

📜 History & Notable Incidents

First observed in 2021, Bofamet was used in a prominent 2022 campaign targeting the Colombian Ministry of Health and social security entities, exploiting CVE-2017-11882 (Equation Editor vulnerability) to deliver payloads. In 2023, Blind Eagle continued refining Bofamet with upgraded encryption and anti-debugging features, as reported by Kaspersky's Global Research and Analysis Team. No law enforcement actions have been publicly reported against the group as of early 2024.

🔍 Detection Indicators

Known file hashes for Bofamet include SHA256 2a3b5c8d7e9f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6 and MD5 e1d2a3b4c5d6e7f8a9b0c1d2e3f4a5b6 from VirusTotal samples analyzed in 2022. Behavioral indicators include the creation of scheduled tasks named SystemCheck and registry modifications under HKCUSoftwareMicrosoftWindowsCurrentVersionRunSystemUpdate. Network IOCs show HTTP POST requests to URLs containing /api/upload with User-Agent strings mimicking Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36. A mutex named BofametMutex is commonly created upon execution.

☠️ Risk & Impact

Bofamet enables long-term surveillance and data theft, leading to potential financial losses from economic espionage and exposure of sensitive government and corporate information. The primary impact is on Colombian critical infrastructure, including energy and healthcare sectors, with documented exfiltration of confidential documents that could compromise national security.

🛡️ Mitigation

Defenders should enforce macro-blocking policies, apply patches for CVE-2017-11882 and other Microsoft Office vulnerabilities, and deploy EDR solutions with behavioral detection rules for .NET-based process anomalies and C2 traffic patterns. Regular user training on spear-phishing awareness and email attachment safety is essential to reduce initial infection risk.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.