MalwareUsed by 2 actorsExploits 3 CVEs

Buhtrap

Buhtrap is a Windows backdoor associated with the Buhtrap cybercrime and espionage group. Initially linked to financially motivated intrusions against Russian businesses and financial institutions, the group later targeted governmental entities in Eastern Europe and Central Asia. Buhtrap campaigns have used malicious documents with benign, contextually relevant decoy content to deliver NSIS-based droppers that install the primary backdoor. The malware ecosystem has employed Windows local privilege-escalation vulnerabilities, including CVE-2019-1132, to obtain elevated execution. Campaign components have established persistence, stolen passwords from browsers and email clients, exfiltrated those credentials to command-and-control infrastructure, and used DLL side-loading through legitimate applications to launch the main backdoor. Buhtrap operators have also used valid code-signing certificates and other tools to reduce detection.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

3 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

3 CVES

CVE-2015-2387ATMFD.DLL Memory Corruption Privilege Escalation in Microsoft WindowsExploited in the wild

Throughout the years, packages with different functionalities appeared. Recently, we found two new packages that are worth describing as they deviate from the typical toolset. ... We’ve seen them exploit old vulnerabilities such as CVE-2015-2387. However, they were always known vulnerabilities. | Throughout our tracking, we’ve seen this group deploy its main backdoor as well as other tools against various victims... One of the first malicious samples we analyzed that targeted governmental organizations was a sample ... This NSIS installer downloads the regular package containing the Buhtrap backdoor.

via eset welivesecurity blogwelivesecurity.com

CVE-2019-1132Win32k Elevation of Privilege VulnerabilityExploited in the wild

In that case, we observed Buhtrap using a local privilege escalation exploit, CVE-2019-1132, against one of its victims. The exploit abuses a local privilege escalation vulnerability in Microsoft Windows, specifically a NULL pointer dereference in the win32k.sys component. | Throughout our tracking, we’ve seen this group deploy its main backdoor as well as other tools against various victims... One of the first malicious samples we analyzed that targeted governmental organizations was a sample ... This NSIS installer downloads the regular package containing the Buhtrap backdoor.

via eset welivesecurity blogwelivesecurity.com

CVE-2015-2546Win32k Use-After-Free Elevation of Privilege in Microsoft WindowsExploited in the wild

CVE-2015-2546 Classification: 1-Day Basic Description: Use-After-Free in xxxSendMessage (tagPOPUPMENU) ... Found in the following Malware samples: Ursnif, Buhtrap | Found in the following Malware samples: Ursnif, Buhtrap

via checkpoint research blogresearch.checkpoint.com

THREAT ACTORS

Groups observed using it

2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Cobalt Group

Tools SpicyOmelette, Cobalt Strike, Meterpreter, Mimikatz, CobtInt, ATMSpitter, Carbanak, Buhtrap, Cyst, Metasploit

via secureworks threat profilessecureworks.com

BuhTrap

Throughout our tracking, we’ve seen this group deploy its main backdoor as well as other tools against various victims... One of the first malicious samples we analyzed that targeted governmental organizations was a sample ... This NSIS installer downloads the regular package containing the Buhtrap backdoor.

via eset welivesecurity blogwelivesecurity.com

MITRE ATT&CK

Techniques & procedures

13 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

3 techniques

T1053Scheduled Task/JobEvidence1

MITRE ATT&CK techniques Tactic ID Name Description Persistence T1053 Scheduled Task Some of the packages create a scheduled task to be executed periodically.

T1106Native APIEvidence1

MITRE ATT&CK techniques Tactic ID Name Description Execution T1106 Execution through API Executes additional malware through CreateProcess.

T1204User ExecutionEvidence1

MITRE ATT&CK techniques Tactic ID Name Description Execution T1204 User execution The user must run the executable.

Persistence

1 technique

T1053Scheduled Task/JobEvidence1

MITRE ATT&CK techniques Tactic ID Name Description Persistence T1053 Scheduled Task Some of the packages create a scheduled task to be executed periodically.

Privilege Escalation

2 techniques

T1053Scheduled Task/JobEvidence1

MITRE ATT&CK techniques Tactic ID Name Description Persistence T1053 Scheduled Task Some of the packages create a scheduled task to be executed periodically.

T1068Exploitation for Privilege EscalationEvidence1

we managed to track down more than 10 (!) of their Windows Kernel Local Privilege Escalation (LPE) exploits, many of which were zero-days at the time of development.

Credential Access

2 techniques

T1056Input CaptureEvidence1

MITRE ATT&CK techniques Tactic ID Name Description Credential Access T1056 Input Capture Backdoor contains a keylogger.

T1111Multi-Factor Authentication InterceptionEvidence1

MITRE ATT&CK techniques Tactic ID Name Description Credential Access T1111 Two-Factor Authentication Interception Backdoor actively searches for a connected smart card.

Collection

2 techniques

T1056Input CaptureEvidence1

MITRE ATT&CK techniques Tactic ID Name Description Credential Access T1056 Input Capture Backdoor contains a keylogger.

T1115Clipboard DataEvidence1

MITRE ATT&CK techniques Tactic ID Name Description Collection T1115 Clipboard Data Backdoor logs clipboard content.

Command and Control

2 techniques

T1071Application Layer ProtocolEvidence1

MITRE ATT&CK techniques Tactic ID Name Description Command and Control T1071 Standard Application Layer Protocol HTTPS is used.

T1105Ingress Tool TransferEvidence1

MITRE ATT&CK techniques Tactic ID Name Description Command and Control T1105 Remote File Copy Backdoor can download and execute file from C&C server.

Exfiltration

2 techniques

T1020Automated ExfiltrationEvidence1

MITRE ATT&CK techniques Tactic ID Name Description Exfiltration T1020 Automated Exfiltration Log files are automatically exfiltrated.

T1041Exfiltration Over C2 ChannelEvidence1

MITRE ATT&CK techniques Tactic ID Name Description Exfiltration T1041 Exfiltration Over Command and Control Channel Exfiltrated data is sent to a server.

Impact

2 techniques

T1499.001OS Exhaustion FloodEvidence1

our exploit samples use a different memory shaping technique than the one described in the initial report: spraying Windows instead of Accelerator Tables.

T1657Financial TheftEvidence1

GOLD KINGSWOOD has also attempted to move funds using the SWIFT network and has attacked other financial systems such as credit card processing systems and payment gateways.

INDICATORS OF COMPROMISE

IOCs tracked for this family

22 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

10 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

8 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

4 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

hash.sha256●●●●●●●●●●●●View more in app6 years ago

uri●●●●●●●●●●●●View more in app7 years ago

domain●●●●●●●●●●●●View more in app7 years ago

hash.sha1●●●●●●●●●●●●View more in app7 years ago

ACTIVITY FEED

Recent activity

7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

7 SOURCESView more in app

slideshareNews

Jan 1, 2026

Hi-Tech Crime Trends 2016 | PDF

Banking malware targeting core banking systems; also listed among Russian-speaking PC trojans.

trmlabsNews

Apr 5, 2022

TRM Analysis Corroborates Suspected Ties Between Conti and Ryuk Ransomware Groups and Wizard Spider | TRM Labs

Referenced only as a historical example of malware source code being leaked after disputes over profit sharing.

securelistNews

Oct 21, 2021

Russian-speaking cybercrime evolution: What changed from 2016 to 2021 | Securelist

Referenced as a major banking-focused malware/cybercrime operation active against Russian financial institutions.

checkpoint research blogNews

Oct 2, 2020

Graphology of an Exploit - Hunting for exploits by looking for the author's fingerprints - Check Point Research

Malware/crimeware family cited as using Volodya-linked Windows LPE exploits; also referenced in relation to later cyber-espionage activity.

+3 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching22

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution2

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities3

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping13

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Buhtrap