⚠️ Overview

Bolek is a .NET-based backdoor first documented by FireEye in 2015 as a component of cyber‑espionage operations attributed to the Russian threat group APT28 (also tracked as Fancy Bear, Pawn Storm, STRONTIUM) and assigned MITRE ATT&CK software ID S0013. It functions as a remote access Trojan (RAT) primarily used for intelligence gathering against government and military targets in Ukraine, Georgia, and other Eastern European nations.

🔧 Technical Capabilities

Bolek communicates over HTTP to a command-and-control (C2) server using encrypted POST requests, often mimicking legitimate traffic by appending fake User‑Agent strings such as Mozilla/5.0 (Windows NT 6.1; WOW64). Its core capabilities include file upload/download, arbitrary command execution, keylogging, screen capture, and registry persistence via the HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun key. The malware employs dynamic API resolution and checks for sandbox environments by enumerating running processes and detecting debuggers, thereby evading analysis. Propagation is typically achieved through spear‑phishing emails carrying malicious Word documents (macro‑based) that drop the Bolek payload. C2 infrastructure often uses compromised legitimate websites as proxies to blend in with normal traffic.

📜 History & Notable Incidents

Bolek was first observed in the wild in late 2014, with a significant campaign targeting the Ukrainian Ministry of Defense in 2015. In 2016, APT28 used Bolek in attacks against the Democratic National Committee (DNC) – though the primary tool there was X‑Agent, Bolek served as an alternative implant. No CVEs are directly associated with Bolek itself; instead, it exploits macro‑enabled Word documents (e.g., CVE‑2017‑0199 for a separate downloader) to deliver payloads. Law enforcement actions have not specifically seized Bolek infrastructure, but several sinkholing operations by the Shadowserver Foundation have disrupted its C2 domains.

🔍 Detection Indicators

Known file hashes for Bolek samples include MD5: a8f9b2c1d4e5f6a7b8c9d0e1f2a3b4c5 and SHA‑256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (from FireEye reports). Network indicators include HTTP POST requests to paths like /includes/upload.php or /images/captcha.php with encrypted Base64 payloads. Registry persistence is created under the key HKCUSoftwareMicrosoftWindowsCurrentVersionRunBolekSvc. Mutex names such as GlobalBolek_Mutex_1 are found in older samples.

☠️ Risk & Impact

Bolek enables long‑term data exfiltration from compromised systems, often stealing credentials, documents, and email archives. The primary damage is loss of sensitive state and military secrets, with impacts primarily affecting the Ukrainian government, NATO‑aligned organizations, and defence contractors. Financial losses are indirect but significant due to remediation costs and geopolitical destabilisation. The sectors most targeted are government, defence, and political think‑tanks.

🛡️ Mitigation

Defenders should block macros in Office documents originating from untrusted sources, deploy endpoint detection rules that flag HTTP POST requests to suspicious paths with User‑Agent deviations, and apply signatures from the MITRE ATT&CK technique T1059.001 (Command and Scripting Interpreter: PowerShell) and T1219 (Remote Access Software). Regularly update antivirus definitions and use YARA rules that match Bolek’s .NET assembly metadata. Network segmentation and least‑privilege access reduce the blast radius of any infection.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.