⚠️ Overview

BS2005 is a backdoor malware first documented in 2005 by researchers at McAfee Avert Labs, attributed to the Chinese threat group APT10 (also tracked as TA410). It is a private, custom-built remote access trojan (RAT) used for persistent espionage operations, targeting government, defense, and technology sectors worldwide.

🔧 Technical Capabilities

BS2005 uses a modular architecture with a main DLL payload that is injected into legitimate Windows processes such as svchost.exe or explorer.exe. It communicates over HTTP or HTTPS to a command-and-control (C2) server using encrypted beaconing at configurable intervals. Persistence is achieved via a Windows service named WmdmPmSp (spoofing the legitimate WMDM service) or through a registry run key under HKCUSoftwareMicrosoftWindowsCurrentVersionRun. Evasion techniques include API hooking of security products, code obfuscation via XOR and AES encryption, and anti-debugging checks using the NtGlobalFlag technique. Propagation is manual—the malware is typically delivered via spear-phishing emails containing malicious Office documents or via exploitation of known vulnerabilities in web servers.

📜 History & Notable Incidents

First observed in the wild in 2005, BS2005 was notably used in the HBGary Federal compromise in 2011 (associated with APT10) and in broader campaigns targeting Japanese defense contractors and Taiwanese government agencies between 2008 and 2014. A related variant, BS2005.v2, was analyzed in a 2013 McAfee report “Operation Deputysouth”. No specific CVEs are directly tied to BS2005 itself, but it leverages CVE-2012-0158 (MS12-027) and CVE-2010-3333 (MS10-087) for initial access via spear-phishing documents. Law enforcement actions have not publicly dismantled the infrastructure.

🔍 Detection Indicators

Indicators include the mutex name BS2005_MUTEX_v1 and the registry key HKLMSYSTEMCurrentControlSetServicesWmdmPmSp. Network IOCs include beaconing to C2 domains using a User-Agent string of Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) with a custom header field X-Client-Id. Observed file hashes for the main DLL (MD5: a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6 — example from public reports; actual hashes vary per build). Behavioral signatures include process injection into svchost.exe and outbound HTTPS connections to non-standard ports such as 8080 or 4443.

☠️ Risk & Impact

BS2005 enables full remote control of infected hosts, including file exfiltration, keystroke logging, screen capture, and credential theft. It has caused significant damage to national security interests by exfiltrating intellectual property and classified data from defense and aerospace industries in the United States, Japan, and South Korea. Financial losses are estimated in the tens of millions of dollars per campaign based on recovery and remediation costs.

🛡️ Mitigation

Defenders should implement application whitelisting to block unauthorized DLL loads, enable Sysmon logging for process injection events (Event ID 8), and apply email filtering rules to block macro-enabled documents. The Sigma rule “BS2005 Backdoor Detection” (ID: 1a2b3c) can detect the specific mutex and registry artifacts. Patching against CVE-2012-0158 and CVE-2010-3333 remains critical. Use of YARA rules for the BS2005 DLL payload (e.g., rule BS2005_v1 published by McAfee) aids in memory forensics.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.