Loading malware…
BendyBear is a novel x64 stage-zero shellcode downloader identified by Unit 42 and assessed to be strongly related to the WaterBear malware family. Its sole documented function is to download a more robust implant from a command-and-control (C2) server. WaterBear has been associated with the BlackTech cyber-espionage group, which multiple agencies and researchers have linked to China; BendyBear was also listed by U.S. and Japanese agencies among custom malware used in BlackTech operations targeting Cisco routers and organizations in the United States and Japan.
The malware is unusually large for shellcode, uses position-independent code, and employs advanced stealth and anti-analysis features. Reported behaviors include polymorphic/self-modifying code with byte randomization, runtime encryption/decryption of code blocks, and timing/debug checks using kernel32!GetTickCount. It also attempts anti-debugging by reading PEB fields such as BeingDebugged and BitField, and resolves APIs through standard shellcode API hashing after locating Kernel32.dll via the PEB loader list. BendyBear can load and execute modules and Windows API calls, and it loads dependencies including Advapi32.dll, Kernel32.dll, Msvcrt.dll, User32.dll, and Ws2_32.dll.
For host discovery and configuration, BendyBear can query the Windows Registry key HKEY_CURRENT_USER\Console\QuickEdit to retrieve data and derive configuration values, and it can determine local time on a compromised host. During execution it decrypts an internal 1,152-byte configuration structure that includes two 16-byte XOR keys and a shellcode version value shown as 0.24.
For C2, BendyBear uses authenticated communications over TCP/port 443 with a custom protocol described as modified RC4- and XOR-encrypted chunks or a custom RC4/XOR-encrypted protocol. It generates unique session keys per connection, sends an initial 10-byte challenge request plus 32 bytes of session keys, and transfers payload chunks up to 4,086 bytes. Before each C2 attempt it flushes the host DNS cache by calling DnsFlushResolverCache to force fresh resolution of the C2 domain.
After downloading a payload, BendyBear validates it as a Windows PE DLL and executes it via direct in-memory loading without creating normal PEB LDR_DATA_TABLE_ENTRY records, which reduces module visibility; anomalous MEM_PRIVATE RWX regions were noted as artifacts. High-confidence indicators mentioned in the content include SHA-256 64CC899EC85F612270FCFB120A4C80D52D78E68B05CAF1014D2FE06522F1E2D0 and C2 domain wg1.inkeslive[.]com for the analyzed x64 sample, as well as an x86 sample SHA-256 49901034216a16cfd05c613f438eccee4a7bf6079a7988b3e7094d9498379558 and domain web2008.rutentw[.]com.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
the agencies said they have observed multiple Cisco versions targeted with custom malware, including BendyBear, Bifrose, BTSDoor FakeDead (a.k.a. TSCookie), Flagpro, FrontShell (FakeDead’s downloader module) IconDown PLEAD, SpiderPig, SpiderSpring, SpiderStack and WaterBear.
17 distinct techniques documented for this family, organized by ATT&CK tactic.
Specifically, upon gaining an initial foothold into a target network and gaining administrator access to network edge devices, BlackTech cyber actors often modify the firmware to hide their activity across the edge devices to further maintain persistence in the network.
The content repeatedly describes payloads, strings, configuration files, scripts, URLs, and binaries being obfuscated or encoded using Base64, XOR, RC4, AES, RSA, hex encoding, custom algorithms, and other methods across many malware families and threat actors.
Transmits payloads in modified RC4-encrypted chunks... Table 1 ... Payloads in modified RC4-encrypted chunks ... T1027.002: Obfuscated Files or Information: Software Packing
Examples throughout the content include 'encrypted payloads decrypted and executed in memory,' 'encrypts its configuration file,' 'AES-encrypted resource,' 'RC4 encrypted embedded scripts,' and 'payload includes an encrypted main component.'
Specifically, upon gaining an initial foothold into a target network and gaining administrator access to network edge devices, BlackTech cyber actors often modify the firmware to hide their activity across the edge devices to further maintain persistence in the network.
Specifically, upon gaining an initial foothold into a target network and gaining administrator access to network edge devices, BlackTech cyber actors often modify the firmware to hide their activity across the edge devices to further maintain persistence in the network.
The content repeatedly describes malware and threat actors querying, enumerating, opening, and reading Windows Registry keys and values, e.g., "APT41 queried registry values to determine items such as configured RDP ports and network configurations" and "Reg may be used to gather details from the Windows Registry of a local or remote system at the command-line interface."
The shellcode begins by locating the target’s Process Environment Block (PEB) to check if it’s currently being debugged... This routine is performed 52 times... Table 1 ... T1082: System Information Discovery
Multiple malware and threat groups are described as collecting/deriving local system time, date, timestamp, tick count, or time zone (e.g., "used time /t and net time \ip/hostname for system time discovery"; "collects the timestamp from the victim’s machine"; "can collect the time zone information from the system").
9 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Custom malware observed in BlackTech operations targeting Cisco routers and enterprise networks.
An x64 stage-0 shellcode stager/downloader that authenticates to a C2, uses modified RC4 plus additional XOR operations, transfers payloads in encrypted chunks, employs polymorphic/self-modifying code and anti-analysis checks, flushes DNS cache before C2 connections, and direct-memory loads a downloaded DLL payload (MEM_PRIVATE, RWX) without standard PEB loader entries.
Malware that retrieves host data by querying specific registry keys.
Malware that queries specific user Registry keys to retrieve host configuration data.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.