BUBBLEWRAP — Malware Profile

BUBBLEWRAP is a full-featured, second-stage backdoor used by the admin@338 group. It is set to run when the system boots and includes functionality to check, upload, and register plug-ins that can further enhance its capabilities.

MITRE ATT&CK techniques (3)

• T1071.001 Web Protocols
• T1082 System Information Discovery
• T1095 Non-Application Layer Protocol

Attributed threat actors

• admin@338

Read the full analysis on IntelFusions