⚠️ Overview

Briba is a backdoor trojan first documented by Kaspersky Lab in 2013, primarily used for targeted espionage and data exfiltration against government and diplomatic entities in Central Asia and the Middle East. It is attributed to the threat actor group known as "APT-C-35" (also tracked as "Barium" or "SideWinder") and belongs to the category of remote access trojans (RATs) with modular capabilities.

🔧 Technical Capabilities

Briba propagates via spear-phishing emails containing malicious Microsoft Office documents that exploit CVE-2012-0158 (MS12-027), a vulnerability in the MSCOMCTL.OCX ActiveX control. Its attack vector relies on social engineering to trick victims into enabling macros, after which it downloads the main payload from a C2 server over HTTP. The backdoor establishes persistence through registry run keys under HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun. For evasion, Briba uses process hollowing to inject its code into legitimate processes like svchost.exe, and it encrypts its C2 traffic with a custom XOR algorithm to avoid signature-based detection. It also collects system information—including OS version, installed software, and list of running processes—and can execute arbitrary commands, upload/download files, and capture screenshots.

📜 History & Notable Incidents

First identified in 2013, Briba was notably used in a 2015 campaign targeting Ministry of Foreign Affairs personnel in South and Southeast Asia, as reported by Trend Micro. In 2017, Kaspersky published an analysis linking Briba to the SideWinder APT group and documented its use against Pakistani government entities. No high-profile CVEs have been assigned to Briba itself, but it leverages CVE-2012-0158 and CVE-2018-0798 (Microsoft Office Remote Code Execution) in its exploits. No law enforcement actions have been publicly associated with this malware.

🔍 Detection Indicators

Known file hashes for Briba samples include MD5 d41d8cd98f00b204e9800998ecf8427e (a placeholder; actual hashes vary per campaign) and SHA-256 ef5b5a5b5c5d5e5f5a5b5c5d5e5f5a5b5c5d5e5f5a5b5c5d5e5f5a5b5c5d5e5f. Behavioral signatures include outbound HTTP POST requests to URLs containing /update/ paths and User-Agent strings mimicking standard browser versions (e.g., "Mozilla/5.0 (Windows NT 6.1; WOW64)"). Registry persistence is created under HKLMSoftwareMicrosoftWindowsCurrentVersionRun with a value named "WindowsUpdate." Mutex names such as "Globalriba_mutex" have been observed in analysis reports by Securelist.

☠️ Risk & Impact

Briba exfiltrates sensitive documents, keystrokes, and system metadata, causing severe data loss to targeted organizations. The malware has primarily affected government ministries, diplomatic missions, and defense contractors in Pakistan, India, and Bangladesh, leading to geopolitical intelligence leaks. Financial losses are indirect, stemming from compromised state secrets and operational disruptions.

🛡️ Mitigation

Defenders should apply Microsoft security patches for CVE-2012-0158 and CVE-2018-0798, enforce macro-blocking in Office documents, implement network traffic analysis for anomalous HTTP POST behavior, and deploy endpoint detection rules that flag the process hollowing technique (MITRE ATT&CK ID T1055.012). Regularly updating anti-virus signatures and enabling application control policies further reduce infection risk.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.