BrockenDoor

BrockenDoor is a backdoor malware family used in phishing-led intrusions targeting Russian organizations. It has been linked in the provided reporting to BO Team (also known as Black Owl, Hoody Hyena, and Lifting Zmiy), a pro-Ukraine hacktivist group active since at least early 2024, and has been observed alongside other malware including Remcos and DarkGate. Initial access is typically achieved through targeted phishing emails with malicious attachments, including password-protected RAR archives and executables disguised as legitimate documents, sometimes using Unicode right-to-left override filename masquerading or PDF icons and spacing to conceal the .exe extension.

Researchers described BrockenDoor as a previously unknown backdoor and later observed an updated version rewritten in C#. In the 2025 BO Team campaign, the rewritten variant would only execute if a Russian keyboard layout was present. Earlier analyzed samples stored the main code in the resource section and encrypted it with XOR using the key d=k,j:Z:M<-JLa+.~kX,gTemp. BrockenDoor communicates with command-and-control infrastructure over port 6180 in at least one documented variant, attempting to contact wmiadap[.]cfd or wmiadap[.]sbs. After connecting, it profiles the victim by sending the victim identifier, username, computer name, OS version, network adapter information, running processes, and a desktop file listing.

Documented BrockenDoor capabilities include changing its polling interval, writing and executing files received from C2, self-deletion, and executing commands via cmd.exe or PowerShell. In the newer C# rewrite, abbreviated commands replaced earlier names, including spi for polling interval changes, rp for creating and launching a received file, sd for delayed self-destruction via PowerShell, and ec for command execution through cmd.exe or PowerShell; rl was declared but not implemented at the time of analysis.

BrockenDoor has also been used as a delivery mechanism for follow-on payloads. In one observed case, it downloaded and executed an updated ZeronetKit backdoor and was used to copy that payload into the Windows Startup folder because ZeronetKit could not establish persistence on its own. On at least one infected host in an earlier campaign, attackers used PowerShell to download and execute the Tuoni post-exploitation tool via rundll32.

High-confidence indicators mentioned in the content include MD5 a8e35c05fd6324119b719aca8ab85f57 for one BrockenDoor sample; the masqueraded filename Scan_Kartochka_[CompanyName]_ann‮fdp.exe; C2 domains wmiadap[.]cfd and wmiadap[.]sbs over port 6180; and, in the 2025 campaign context, delivery via a password-protected archive named Приказ_протокол.rar.