Malware

Bolek

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

7 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1091Replication Through Removable MediaEvidence1

"malicious capabilities which include self-spreading through USB and network shares"

Stealth

1 technique

T1027Obfuscated Files or InformationEvidence1

"the config is no longer stored in clear text on the binary and is now obfuscated"

Credential Access

1 technique

T1056.003Web Portal CaptureEvidence1

"malicious capabilities which include self-spreading through USB and network shares, TOR network access, screen captures and web injects"

Lateral Movement

2 techniques

T1091Replication Through Removable MediaEvidence1

"malicious capabilities which include self-spreading through USB and network shares"

T1570Lateral Tool TransferEvidence1

"malicious capabilities which include self-spreading through USB and network shares"

Collection

2 techniques

T1056.003Web Portal CaptureEvidence1

"malicious capabilities which include self-spreading through USB and network shares, TOR network access, screen captures and web injects"

T1113Screen CaptureEvidence1

"malicious capabilities which include self-spreading through USB and network shares, TOR network access, screen captures and web injects"

Command and Control

2 techniques

T1090.003Multi-hop ProxyEvidence1

"malicious capabilities which include self-spreading through USB and network shares, TOR network access"

T1573Encrypted ChannelEvidence1

"uses asymmetric cryptography to secure network communications"

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

arbor networksNews

Aug 14, 2026

TrickBot Banker Insights | NETSCOUT

Named as another banking malware previously distributed via Godzilla Loader.

bitsightNews

Oct 6, 2016

Bolek - An evolving botnet targets Poland and Ukraine

A malware family related to Kbot/Carberp that was actively updated and used in botnets targeting Ukraine and Poland. Its capabilities include spreading via USB and network shares, TOR access, screen capture, web injects, and encrypted network communications using asymmetric cryptography.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping7

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

Bolek

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

7 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1091Replication Through Removable MediaEvidence1

"malicious capabilities which include self-spreading through USB and network shares"

Stealth

1 technique

T1027Obfuscated Files or InformationEvidence1

"the config is no longer stored in clear text on the binary and is now obfuscated"

Credential Access

1 technique

T1056.003Web Portal CaptureEvidence1

"malicious capabilities which include self-spreading through USB and network shares, TOR network access, screen captures and web injects"

Lateral Movement

2 techniques

T1091Replication Through Removable MediaEvidence1

"malicious capabilities which include self-spreading through USB and network shares"

T1570Lateral Tool TransferEvidence1

"malicious capabilities which include self-spreading through USB and network shares"

Collection

2 techniques

T1056.003Web Portal CaptureEvidence1

"malicious capabilities which include self-spreading through USB and network shares, TOR network access, screen captures and web injects"

T1113Screen CaptureEvidence1

"malicious capabilities which include self-spreading through USB and network shares, TOR network access, screen captures and web injects"

Command and Control

2 techniques

T1090.003Multi-hop ProxyEvidence1

"malicious capabilities which include self-spreading through USB and network shares, TOR network access"

T1573Encrypted ChannelEvidence1

"uses asymmetric cryptography to secure network communications"

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

arbor networksNews

Aug 14, 2026

TrickBot Banker Insights | NETSCOUT

Named as another banking malware previously distributed via Godzilla Loader.

bitsightNews

Oct 6, 2016

Bolek - An evolving botnet targets Poland and Ukraine

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping7

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.