BONDUPDATER — Malware Profile

BONDUPDATER is a PowerShell backdoor used by OilRig. It was first observed in November 2017 during targeting of a Middle Eastern government organization, and an updated version was observed in August 2018 being used to target a government organization with spearphishing emails.

MITRE ATT&CK techniques (7)

• T1053.005 Scheduled Task
• T1059.001 PowerShell
• T1059.003 Windows Command Shell
• T1071.004 DNS
• T1105 Ingress Tool Transfer
• T1564.003 Hidden Window
• T1568.002 Domain Generation Algorithms

Attributed threat actors

• OilRig

Read the full analysis on IntelFusions