Loading malware…
Bisonal is a Windows remote access trojan/backdoor (RAT) associated with Chinese cyber espionage activity and repeatedly linked in reporting to Tonto Team/CactusPete/Earth Akhlut, with some infrastructure and tooling overlaps also noted with broader China-linked activity including Winnti/ShadowPad-related operations. It has been used in spearphishing campaigns in which victims execute malicious attachments, including malicious email attachments, Office documents, Royal Road-built documents, RTF files, and executables disguised as PDF documents; reported delivery chains also exploited CVE-2018-0798 and CVE-2018-20250. Reported targeting includes government, military, defense, financial, telecommunications, critical infrastructure, and private-sector organizations, including victims in Russia, Eastern Europe, South Korea, Japan, Pakistan, India, and elsewhere.
Documented capabilities include unrestricted remote control, command execution, file searching, file upload/download, exfiltration, host and service/process information gathering, and anti-analysis checks such as determining whether the host is running on VMware. Bisonal has used raw sockets in some variants, while newer variants rewrote network communications to use WinINet APIs such as HttpSendRequest() and InternetReadFile(). It supports proxy-aware operation, including querying proxy settings from the Windows Registry via RegQueryValueExA and use of a proxy server. It has encoded binary data with Base64 and ASCII, and has exfiltrated data by appending it to URLs over the C2 channel. Reported C2 patterns include HTTP POST over port 443, DDNS-based infrastructure, and RC4-encrypted communications in newer variants; one reported variant used static strings "ks8d" and "akspbu.txt" in its initial request and sent a consistent initial encrypted beacon value 81b2a8977ea31b91.
Persistence and defense-evasion behaviors include modification for use as a Windows service, Registry Run-key persistence, and masquerading by naming malicious components msacm32.dll, winhelp, or pvcu.dll. One reported Run key was HKCU\Software\Microsoft\Windows\CurrentVersion\Run"vert" = "rundll32.exe c:\windows\temp\pvcu.dll , Qszdez". Bisonal has also deleted Registry keys, its dropper, and VBS scripts to clean up activity. Reported infrastructure and indicators include domains such as news.wooordhunts[.]com, supportteam.lingrevelat[.]com, upportteam.lingrevelat[.]com, instructor.giize[.]com, kted56erhg.dynssl[.]com, and euiro8966.organiccrap[.]com, and IPs including 137.220.176[.]165, 198.13.56[.]122, and 116.193.155[.]38.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The example documents shown above both exploit CVE-2018-0798, a remote execution vulnerability in Microsoft Office to install the embedded malware. | The attacks use phishing emails to deliver Office documents to exploit targets in order to deliver their RAT of choice, most commonly Bisonal.
Among our finds on the server were utilities for lateral movement... The server had the following utilities: Utilities to check for and exploit vulnerability MS17-010... The hackers tweaked the functionality of the MS17-010 utility by adding the ability to check an entire subnet.
May 2018: a new wave of targeted attacks abusing CVE-2018-8174 (this exploit has been associated with the DarkHotel APT group, as described on Securelist), with diplomatic, defense, manufacturing, military and government targets in Asia and Eastern Europe;
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The attacks use phishing emails to deliver Office documents to exploit targets in order to deliver their RAT of choice, most commonly Bisonal.
On one of the IP addresses on ShadowPad infrastructure, we found domains used in Bisonal RAT attacks in 2015–2020.
28 distinct techniques documented for this family, organized by ATT&CK tactic.
The attacks use phishing emails to deliver Office documents to exploit targets in order to deliver their RAT of choice, most commonly Bisonal.
admin@338 has attempted to get victims to launch malicious Microsoft Word attachments delivered via spearphishing emails... APT28 attempted to get users to click on Microsoft Office attachments containing malicious macro scripts... Dragonfly has used various forms of spearphishing in attempts to get users to open malicious attachments.
CERT-UA assessed that the documents... were likely built with the Royal Road builder and dropped the Bisonal backdoor.
During the 2016 Ukraine Electric Power Attack, Sandworm Team used the xp_cmdshell command in MS-SQL. During the 2025 Poland Wiper Attacks, the adversaries leveraged PsExec to run cmd.exe commands on multiple victim machines. Numerous malware families and groups are described as using cmd.exe, cmd /c, Windows command shell, or command-line interfaces to execute commands, payloads, reconnaissance, persistence, cleanup, and ransomware actions.
The example documents shown above both exploit CVE-2018-0798, a remote execution vulnerability in Microsoft Office to install the embedded malware.
The content repeatedly describes victims being lured into opening malicious attachments, enabling macros, launching installers, clicking embedded files/links, or otherwise directly executing malicious content.
Sandworm Team leveraged Microsoft Office attachments which contained malicious macros that were automatically executed once the user permitted them... APT29 has used various forms of spearphishing attempting to get a user to open attachments... DarkGate is distributed through phishing links to VBS or MSI objects requiring user interaction for execution.
During the 2015 Ukraine Electric Power Attack, Sandworm Team modified in-registry Internet settings to lower internet security before launching rundll32.exe ... AADInternals can modify registry keys ... ADVSTORESHELL is capable of setting and deleting Registry values ... [many additional examples].
The content repeatedly describes payloads, strings, configuration files, scripts, URLs, and binaries being obfuscated or encoded using Base64, XOR, RC4, AES, RSA, hex encoding, custom algorithms, and other methods across many malware families and threat actors.
Examples throughout the content include 'encrypted payloads decrypted and executed in memory,' 'encrypts its configuration file,' 'AES-encrypted resource,' 'RC4 encrypted embedded scripts,' and 'payload includes an encrypted main component.'
During the 2016 Ukraine Electric Power Attack, DLLs and EXEs with filenames associated with common electric power sector protocols were used to masquerade files.
Akira has used legitimate names and locations for files to evade defenses.
Bisonal has deleted Registry keys to clean up its prior activity ... FIN8 has deleted Registry keys during post compromise cleanup activities ... SUNBURST ... deleted previously-created Image File Execution Options (IFEO) Debugger registry values and registry keys related to HTTP proxy to clean up traces of its activity.
The content repeatedly describes threat actors and malware deleting files, tools, scripts, logs, droppers, staged data, and artifacts from compromised systems to cover tracks, remove evidence, or self-delete.
The content repeatedly describes malware and threat actors decoding, decrypting, deobfuscating, or unpacking payloads, strings, configuration data, commands, and C2 responses prior to execution or use.
Agent Tesla has the ability to perform anti-sandboxing and anti-virtualization checks. Bisonal can check to determine if the compromised system is running on VMware. Bumblebee has the ability to perform anti-virtualization checks. CozyCar will check to ensure it is not being executed inside a virtual machine or a known malware analysis sandbox environment. Metamorfo has embedded a "vmdetect.exe" executable to identify virtual machines at the beginning of execution. RTM can detect if it is running within a sandbox or other virtualized analysis environment. Saint Bear contains several anti-analysis and anti-virtualization checks.
During the 2015 Ukraine Electric Power Attack, Sandworm Team modified in-registry Internet settings to lower internet security before launching rundll32.exe ... AADInternals can modify registry keys ... ADVSTORESHELL is capable of setting and deleting Registry values ... [many additional examples].
The content repeatedly describes malware and threat actors querying, enumerating, opening, and reading Windows Registry keys and values, e.g., "APT41 queried registry values to determine items such as configured RDP ports and network configurations" and "Reg may be used to gather details from the Windows Registry of a local or remote system at the command-line interface."
The content repeatedly describes malware and threat actors using commands and APIs such as ipconfig /all, ifconfig, arp -a, route print, nbtstat, netsh, GetAdaptersInfo, and GetIpNetTable to gather IP addresses, MAC addresses, DNS, DHCP, gateways, routing tables, ARP cache, proxy settings, domains, and network adapter/interface details.
The content repeatedly describes malware and threat actors obtaining lists of running processes, using utilities such as tasklist, ps, WMI, Get-Process, CreateToolhelp32Snapshot, EnumProcesses, and similar APIs/commands to enumerate active processes on victim systems.
The content is a long ATT&CK-style listing of malware and threat actors that collect host details such as OS version, hostname, architecture, CPU, memory, BIOS, language, and other basic system characteristics; examples include use of commands like systeminfo, ver, uname, sw_vers, and WMI queries.
The content repeatedly describes malware and threat actors listing files and directories, enumerating drives, searching for files by extension/name/path, retrieving file metadata, and browsing file systems (for example: "APT28 has used Forfiles to locate PDF, Excel, and Word documents during collection" and "cmd can be used to find files and directories with native functionality such as dir commands").
Agent Tesla has the ability to perform anti-sandboxing and anti-virtualization checks. Bisonal can check to determine if the compromised system is running on VMware. Bumblebee has the ability to perform anti-virtualization checks. CozyCar will check to ensure it is not being executed inside a virtual machine or a known malware analysis sandbox environment. Metamorfo has embedded a "vmdetect.exe" executable to identify virtual machines at the beginning of execution. RTM can detect if it is running within a sandbox or other virtualized analysis environment. Saint Bear contains several anti-analysis and anti-virtualization checks.
This email contains the Royal Road attachment “Please help to Check.doc” ... and beaconing outbound to instructor.giize[.]com (198.13.56[.]122).
94 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
68 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A backdoor RAT associated with Chinese threat actors, used as the payload delivered via malicious Office documents. It provides long-term remote access and has evolved with capabilities for file searching and exfiltration, anti-analysis and detection evasion, and generally unrestricted system control.
Bisonal is a remote access trojan (RAT) and backdoor primarily used by Chinese state-sponsored threat actors. It provides attackers with persistent access, file searching and exfiltration capabilities, anti-analysis features, and unrestricted system control. It is typically delivered via malicious Office documents exploiting known vulnerabilities.
Software changes: ... Bisonal
Remote access trojan observed sharing infrastructure with ShadowPad and delivered via xDII in attacks (notably against Japanese targets per cited research).
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.