Malware

BISCUIT

BISCUIT is a Windows backdoor associated with long-running espionage activity, including operations linked to APT1. It provides remote operators with interactive control and host-surveillance functions on compromised systems. Documented capabilities include launching a command shell, downloading files from command and control infrastructure, enumerating running processes and their owners, collecting the current username, gathering system uptime, capturing keystrokes, and periodically taking screenshots. BISCUIT also implements encrypted command-and-control communications using SSL and includes a secondary fallback command-and-control server to preserve connectivity if the primary channel is unavailable. Its feature set is consistent with post-compromise reconnaissance, operator tasking, and ongoing collection on victim endpoints.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

11 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

1 technique

T1059.003Windows Command ShellEvidence4

The content repeatedly describes threat actors and malware using cmd.exe, the Windows command shell, to execute commands, launch payloads, run batch files, and automate actions on compromised hosts.

Credential Access

1 technique

T1056.001KeyloggingEvidence2

The content is a catalog of malware families and threat actors that 'can perform keylogging,' 'log keystrokes,' 'capture keystrokes,' or use 'keylogger' modules/tools.

Discovery

4 techniques

T1033System Owner/User DiscoveryEvidence6

The content repeatedly describes malware and threat actors collecting the username, identifying the current user, enumerating logged-on users, or running commands such as whoami, query user, and quser to determine user context on compromised systems.

T1057Process DiscoveryEvidence5

Tasklist can be used to discover processes running on a system. Numerous malware families and threat groups are described as listing running processes, collecting PIDs, checking for specific process names, or enumerating loaded modules.

T1082System Information DiscoveryEvidence10

The content repeatedly describes malware and threat actors collecting OS version, computer name, architecture, CPU, memory, disk, language, and other host details; examples include use of commands such as ver, systeminfo, hostname, uname -m, sw_vers -productVersion, and fsutil.

T1124System Time DiscoveryEvidence1

Collection

2 techniques

T1056.001KeyloggingEvidence2

The content is a catalog of malware families and threat actors that 'can perform keylogging,' 'log keystrokes,' 'capture keystrokes,' or use 'keylogger' modules/tools.

T1113Screen CaptureEvidence4

The content is a MITRE ATT&CK-style listing of malware and threat actors that "can capture screenshots," "take screenshots," "perform screen captures," or "watch the victim's screen." It ends with references to "CopyFromScreen" and "xwd."

Command and Control

4 techniques

T1008Fallback ChannelsEvidence2

APT41 used the Steam community page as a fallback mechanism for C2. Bazar has the ability to use an alternative C2 server if the primary server fails. BISCUIT malware contains a secondary fallback command and control server that is contacted after the primary command and control server.

T1105Ingress Tool TransferEvidence2

The content repeatedly describes malware and threat actors that can "download files from C2," "download additional payloads," "upload and download files," "retrieve payloads from the C2 server," and "copy files to remote machines."

T1573Encrypted ChannelEvidence1

The content repeatedly describes malware and threat actors using SSL, TLS, HTTPS, RSA, AES, Blowfish, RC4, ECIES, Diffie-Hellman, OpenSSL, WolfSSL, and mutual TLS to protect command and control traffic.

T1573.002Asymmetric CryptographyEvidence2

Multiple malware families and intrusion sets are described as encrypting C2 traffic using SSL/TLS/HTTPS (e.g., "used HTTPS for command and control", "encrypts C2 communications with TLS", "uses SSL for encrypting C2 communications", "TLS-encrypted WebSocket Protocol (WSS) for C2").

ACTIVITY FEED

Recent activity

22 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

22 SOURCESView more in app

mitre attack websiteNews

Oct 25, 2022

System Owner/User Discovery, Technique T1033 - Enterprise | MITRE ATT&CK®

Backdoor with a command to gather the username from the system.

mitre attack websiteNews

Oct 21, 2021

System Owner/User Discovery, Technique T1033 - Enterprise | MITRE ATT&CK®

Has a command to gather the username from the system.

mitre attack websiteNews

Oct 21, 2021

Fallback Channels, Technique T1008 - Enterprise | MITRE ATT&CK®

Malware with a secondary fallback C2 server contacted after the primary server.

mitre attack websiteNews

Oct 21, 2021

Screen Capture, Technique T1113 - Enterprise | MITRE ATT&CK®

Backdoor malware that can periodically capture system screenshots.

+18 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping11

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

BISCUIT