Loading malware…
Bifrose is a backdoor malware family associated with the Bifrost codebase, first identified in the early 2000s. Initially targeting Windows, it also has Unix-based variants, including ELF executables targeting Linux. It is used by the China-linked cyberespionage group BlackTech, also known as Earth Hundun, Palmerworm, and BRONZE CANAL. In the Shrouded Crossbow campaign, Bifrose forms part of a Bifrost-derived toolset alongside KIVARS and XBOW.
Bifrose variants communicate with command-and-control servers through Tor to evade detection. Analyzed Linux variants have stripped symbols that hinder analysis and collect host information, including operating-system and kernel versions and timezone settings. Shrouded Crossbow distributes its backdoors through spearphishing emails containing malicious attachments disguised as documents using right-to-left override filename manipulation, often accompanied by decoy documents.
Associated espionage operations have targeted privatized agencies, government contractors, and organizations in consumer electronics, computing, healthcare, and financial services. BlackTech's activity is concentrated in East Asia, particularly Taiwan, with additional targeting in Japan and Hong Kong, and focuses on technology theft and confidential information collection.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
3 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
BIFROSE, known for evading detection by communicating with its C&C servers via Tor protocol, also has a version targeting UNIX-based operating systems.
BRONZE CANAL ... Tools ... Bifrose, Deuterbear, DRIGO, Flagpro, Gh0stTimes, KIVARS, PLEAD, Spiderpig, Waterbear, XBOW
•TSCookie •Waterbear •Bifrose •Consock •LAMICE •BUSYICE •BTSDOOR •DELTABEEF •SPIDERPIG
7 distinct techniques documented for this family, organized by ATT&CK tactic.
A sophisticated hacking group tied to the government of China is exploiting routers in attacks on a variety of organizations... The group specifically targets “branch routers” — smaller appliances used at more remote branch offices to connect to a corporate headquarters.
BlackTech is best known for utilizing network and software exploits for initial access... TeamT5 released a blog post detailing an intrusion at a Taiwan academic institution attributed to BlackTech utilizing the Ghostcat vulnerability, (CVE-2020-1938) for initial access.
PLEAD uses spear-phishing emails to deliver and install their backdoor, either as an attachment or through links to cloud storage services.
Specifically, upon gaining an initial foothold into a target network and gaining administrator access to network edge devices, BlackTech cyber actors often modify the firmware to hide their activity across the edge devices to further maintain persistence in the network.
Like PLEAD, Shrouded Crossbow uses spear-phishing emails with backdoor-laden attachments that utilize the RTLO technique and accompanied by decoy documents.
Specifically, upon gaining an initial foothold into a target network and gaining administrator access to network edge devices, BlackTech cyber actors often modify the firmware to hide their activity across the edge devices to further maintain persistence in the network.
Specifically, upon gaining an initial foothold into a target network and gaining administrator access to network edge devices, BlackTech cyber actors often modify the firmware to hide their activity across the edge devices to further maintain persistence in the network.
Additionally, we can see signs of reconnaissance of the infected system, viewing the version and OS release, as well as the kernel version, and the timezone the target is located in.
In addition to the hard-coded IP addresses, standard strings indicating first contact with the C&C server, notably unix| , 5.0.0.0| , and what appear to be C&C commands (recvData and send data), are visible in the output.
36 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.