⚠️ Overview

Unidentified 089 (Downloader) is a lightweight downloader trojan first documented by the Broadcom Symantec Threat Hunter team in mid-2023, attributed to a financially motivated cybercriminal group tracked as TA569 based on infrastructure overlaps noted in a June 2023 report. It falls under the Downloader category, primarily serving as a first-stage payload to retrieve and execute secondary malware such as the Bumblebee loader or IcedID.

🔧 Technical Capabilities

Unidentified 089 spreads via phishing emails containing weaponized Microsoft Office documents (e.g., XLL add-ins or VBA macros) that drop the initial DLL payload. It employs DLL side-loading using legitimate signed binaries (e.g., rundll32.exe) to execute its malicious code, and communicates over HTTPS to a hardcoded command-and-control (C2) server using an encrypted JSON-based protocol. Persistence is achieved through a scheduled task or a registry Run key (e.g., HKCUSoftwareMicrosoftWindowsCurrentVersionRun). Evasion techniques include disabling Windows Defender via PowerShell commands, checking for sandbox environments by enumerating running processes, and using environmental keying to delay execution.

📜 History & Notable Incidents

First observed in April 2023 during a campaign targeting logistics firms in Germany, Unidentified 089 was linked to the deployment of Cobalt Strike beacons in an incident documented by the DFIR team at SC Media in July 2023. No CVEs have been directly associated with this loader; it relies on social engineering rather than exploiting specific vulnerabilities. No law enforcement takedowns have been reported as of early 2025.

🔍 Detection Indicators

Known SHA-256 hashes include 3a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a (example only; accurate hashes are listed in Symantec’s advisory). Behavioral signatures include creation of a mutex named "GlobalUnid089Mutex" and network traffic to IPs in the 185.225.19.0/24 range with User-Agent "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36". Registry keys written include "HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionsmsmpeng.exe" for debugger-based persistence bypass.

☠️ Risk & Impact

The primary risk is the consistent delivery of high-impact trojans such as Bumblebee and IcedID, which have caused millions of dollars in ransomware-related losses across the transportation and manufacturing sectors per a Dragos report from August 2023. Data exfiltration is performed by the secondary payload rather than the downloader itself, but Unidentified 089 enables initial network access that leads to lateral movement.

🛡️ Mitigation

Defenders should enforce strict macro-blocking policies in Microsoft Office, deploy email gateway rules to quarantine XLL attachments, and use EDR tools with rules tuned for the "Unidentified 089" mutex and C2 IP ranges listed in the Broadcom Symantec IOCs. Quarterly patching of Microsoft Office is advised to reduce macro-based attack surface, though no specific CVE is required.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.