Loading malware…
BUGHATCH is a custom Windows malware family associated with Cuba ransomware operations and the threat cluster tracked as UNC2596. It functions primarily as an in-memory command-and-control implant and downloader used during post-compromise staging to retrieve and execute additional payloads. Reported deployments place it in Cuba intrusions from at least early 2022, where it was used alongside other tooling such as TERMITE, WEDGECUT, BURNTCIGAR, Cobalt Strike, and NetSupport Manager.
BUGHATCH is capable of downloading and executing arbitrary code and supports multiple execution methods, including shellcode execution, reflective loading of PE payloads, DLL and executable launch, system command execution, and PowerShell script execution. Analyses describe it as multithreaded and able to manage command handling and output collection concurrently. It performs host fingerprinting, communicates with its command-and-control infrastructure over HTTP or HTTPS using a custom protocol with additional XOR-based encryption, and can beacon periodically for tasking.
The malware includes several post-exploitation features. Documented capabilities include process injection, reflective PE loading into suspended child processes, token impersonation, process migration, spawning architecture-specific agents, self-deletion, and attempts to enable SeDebugPrivilege. It has been observed loading entirely in memory to reduce on-disk artifacts and evade detection. In Cuba intrusion chains, BUGHATCH has been delivered by obfuscated PowerShell stagers and by the TERMITE memory-only dropper, and has been used to fetch follow-on scripts and binaries from attacker-controlled infrastructure.
BUGHATCH is best understood as part of the broader Cuba ransomware toolkit rather than as a commodity malware family. Its role is to maintain command-and-control access and stage additional tooling before later actions such as credential theft, lateral movement, defense evasion, data exfiltration, and ransomware deployment. Victimology associated with the surrounding Cuba campaigns includes organizations in the United States, Canada, Europe, Latin America, and Asia, with repeated targeting of critical infrastructure and sectors such as government, finance, healthcare, information technology, manufacturing, retail, and related enterprise environments.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The report highlighted a novel feature of the Cuba group’s operations, exploitation of CVE-2023-27532, a vulnerability affecting Veeam Backup & Replication software.
We observed the execution of the ProxyLogon exploit. Previous research has observed this threat group leveraging ProxyLogon and ProxyShell vulnerabilities to gain initial access.
Previous research has observed this threat group leveraging ProxyLogon and ProxyShell vulnerabilities to gain initial access.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Bughatch is a downloader that fetches PowerShell scripts and files from the C&C server. To evade detection, it loads in memory from a remote URL.
BUGHATCH is the name given to a Cuba Ransomware associated downloader by Mandiant... Based on analysis of the Agent32.bin file, we believe that this is the BUGHATCH malware.
22 distinct techniques documented for this family, organized by ATT&CK tactic.
ExecutePowershell Executes a Powershell script/command ... The malware can either write the script to a file in the temporary folder with a randomly generated name
Command 3 Process injection of a PE file in a suspended child process
The malware creates a suspended svchost.exe process with CreateProcessA API, allocates a memory region for the shellcode sent by the C2 server with VirtualAllocEx, and writes to it with WriteProcessMemory, it then sets the suspended thread instruction pointer to point to the injected shellcode with SetThreadContext and finally it will resume the thread with ResumeThread
ImpersonateToken ... an attacker can either impersonate the explorer.exe token or create a token from credentials (Domain\Username, Password) sent by the C2 to spawn another instance of the current process.
Command 3 Process injection of a PE file in a suspended child process
The malware creates a suspended svchost.exe process with CreateProcessA API, allocates a memory region for the shellcode sent by the C2 server with VirtualAllocEx, and writes to it with WriteProcessMemory, it then sets the suspended thread instruction pointer to point to the injected shellcode with SetThreadContext and finally it will resume the thread with ResumeThread
SelfDeleteExitProcess ... executes the following command to self-delete: cmd.exe /c del FILEPATH >> NUL
ImpersonateToken ... an attacker can either impersonate the explorer.exe token or create a token from credentials (Domain\Username, Password) sent by the C2 to spawn another instance of the current process.
It collects the addresses of network interfaces connected to the infected machine by using the GetIpAddrTable Windows API.
It then retrieves the username and domain of the user account with the LookupAccountSidW API and concatenates the 2 strings in the following format: DOMAIN\USERNAME
the C2 then responds with the operator’s command if available, or else the agent sleeps for 60 seconds ... The main loop is made up of the following: Send POST request ... Sleep for 60 seconds
When launched, the malware will first send an HTTP POST request to the C2 server ... the C2 then responds with the operator’s command
The shellcode downloads another shellcode blob and the encrypted PE implant from the C2 server ... the malware will then do an HTTP GET request to download a packed agent in shellcode format
16 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A custom malware strain used by the Cuba ransomware group for command-and-control. The report links BUGHATCH to infrastructure that served malware downloads and to certificate-based infrastructure clustering associated with Cuba activity.
Downloader malware used by Cuba ransomware group to fetch additional payloads during attacks.
Bughatch is a custom backdoor used by the Cuba ransomware group. It is deployed in process memory, connects to a C2 server, collects system and network information, and can download and execute additional payloads such as Cobalt Strike Beacon or Metasploit modules.
Named as associated malware in the broader CUBA campaign, but no functional details are provided in this reference.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.