Loading malware…
BlackBeard is a malware name used in public reporting for at least two distinct Windows threats. One usage refers to a multi-stage Windows click-fraud malware family also associated with the Pigeon clickbot, active from at least 2012 and notably observed in 2013–2014 campaigns targeting victims in the United States. That malware was distributed through malvertising and drive-by exploitation of Java, used mixed 32-bit and 64-bit execution logic, employed privilege-elevation and UAC-bypass techniques, established persistence by patching a protected system DLL, stored encrypted payloads on disk, and used encrypted command-and-control communications. Its downstream payloads included the Pigeon clickbot and, in some variants, a SOCKS5 proxy component. Pigeon automated hidden browsing and ad-click activity, manipulated browser settings, hooked multiple APIs to suppress visible artifacts, and simulated user interaction to support click-fraud operations.
A separate and more recent usage of the name BlackBeard refers to a Rust-based Windows backdoor also known as Archer RAT and RUSTRIC. This malware has been linked in public reporting to MuddyWater activity targeting organizations in the Middle East. It has been described as structurally similar to another Rust backdoor called CHAR. High-confidence reporting in the available material supports the existence of this Rust-based BlackBeard naming overlap and its association with MuddyWater-linked operations, but does not provide sufficient direct behavioral detail here to characterize its full functionality independently of CHAR.
Because the name BlackBeard is applied to multiple unrelated or insufficiently disambiguated malware strains, analysts should distinguish carefully between the older Blackbeard/Pigeon click-fraud family and the Rust-based BlackBeard/Archer RAT/RUSTRIC cluster when using the term.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The third function (0x4086c0) exploits CVE-2013-3660 [ 8 ]. If this function succeeds, a standard user can run programs under administrator privileges. | The Blackbeard/Pigeon clickbot follows the path that was previously set by ZeroAccess... The variant described in early 2014 distributed its own trojan features via drive-by download.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
CHAR shares a similar structure and development environment as the Rust-based malware BlackBeard (aka Archer RAT and RUSTRIC)...
15 distinct techniques documented for this family, organized by ATT&CK tactic.
The reply to the second POST request is encrypted with RC4. It contains the main module, which is then decrypted, injected into the svchost.exe process, and executed.
The third function (0x4086c0) exploits CVE-2013-3660 [ 8 ]. If this function succeeds, a standard user can run programs under administrator privileges.
The system API ShellExecuteW is resolved with the parameter ‘runas’ to run a file with elevated privileges... The code uses the System Preparation tool (sysprep.exe)... If we put a fake cryptbase.dll library into the sysprep directory, it will load the fake library instead of the real one.
A malicious Java applet is loaded, which creates and drops the notepad.exe file into the %TEMP% directory.
The reply to the second POST request is encrypted with RC4. It contains the main module, which is then decrypted, injected into the svchost.exe process, and executed.
Instead of modifying the above-mentioned registry keys, an important system DLL is patched so that the payload is executed every time the operating system starts.
Communication with the C&C server is encrypted... The initial post always starts with ‘0|’... The second POST request to the C&C server is unencrypted and uses only the previously received hash to request an additional payload.
11 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Rust-based RAT/backdoor previously reported as used by MuddyWater to target entities in the Middle East; mentioned here due to code/structure similarities with CHAR.
Rust-based malware previously reported as used by MuddyWater to target entities in the Middle East; mentioned as structurally similar to CHAR.
Blackbeard is a multi-stage downloader/click-fraud malware family that uses malvertising and Java exploitation for delivery, supports both 32-bit and 64-bit environments, performs privilege elevation and stealthy persistence by patching rpcss.dll, communicates with C2 to fetch additional modules, and installs clickbot or proxy payloads.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.