Buhtrap RAT Resurfaces in New Campaign Targeting Russian Accountants via Search Ads
Specialists from F6 have uncovered a new campaign distributing the Buhtrap RAT remote access trojan. The attackers continue their established tactic of targeting accountants and lawyers with counterfeit professional websites promoted through paid search engine advertisements.
The latest decoy closely replicates the legitimate resource Glavnaya Kniga Bukhgaltera. Visitors arrive seeking a required document and click the download button, only to receive a ZIP archive instead of a harmless file. JavaScript code on the page intercepts the request and dynamically generates a link to the malicious archive, whose filename incorporates the current date and time.
Inside the archive, victims find an executable such as Obrazets dokumenta pod indeksom 1.exe. Upon execution, Buhtrap RAT establishes persistence on the system and connects to the attackers’ command server. The trojan grants remote control over the compromised machine and is deployed in operations against Russian organizations.
Researchers at F6 noted that the infection chain has seen minimal changes compared with the previous campaign. The main update involves refreshed network infrastructure rather than new techniques. Buhtrap has been active since 2014 both as malware and as the name of the associated criminal group. Following the public release of its source code in 2016, the tool became available to various financially motivated threat actors.
Among the identified decoy domains are glavaudit.org, buhotchet.com, and audit24.org. Security experts recommend that users carefully verify website addresses and refrain from launching executable files that masquerade as documents.
Related articles
Brazilian Malware BraZetsu Uses AI to Map and Sell Compromised Corporate Networks
Researchers have identified a new Windows malware called BraZetsu developed by the Brazilian actor Exilware. The tool maps compromised corporate networks, identifies high-value systems, and prepares access for sale to other criminals. The operation primarily targets Brazil and other countries in Latin America and the Iberian Peninsula. BraZetsu is written in Python with a modular architecture and maintains WebSocket communication with its command-and-control server. It searches for banking software, ERPs, e-commerce platforms, industrial environments, development tools, backup systems, and security solutions. The malware also looks for Brazilian CNAB financial files, digital certificates, and browser history. Evidence suggests heavy use of generative AI during development, with an AI component on the server that may classify stolen files and prioritize valuable machines.
Callfuscated: Reverse Engineering a Stack-Based VM Protected by MBA, Opaque Predicates and Call-Based Jumps
A detailed technical write-up examines the HackTheBox challenge Callfuscated, which combines virtualization, mixed Boolean-arithmetic expressions, opaque predicates and junk instructions. The author first converts call-pop sequences into direct jumps by proving that register r8 is never read, then removes the resulting NOPs to obtain clean code. The resulting binary reveals a classic stack-based virtual machine whose handlers invoke heavily obfuscated functions. Triton is used to lift these functions into AST form, after which the CoBRA solver simplifies the MBA expressions into the original operations: addition, subtraction, multiplication, XOR, OR and AND. With semantics recovered, the author captures the bytecode at runtime, writes a C translator that emits readable operations, compiles the output and obtains a clean decompiled routine that checks the flag.
Backblaze Responds in Minutes While reg.ru Delays Action on Banking Trojan Infrastructure
A detailed reverse-engineering report reveals a sophisticated Android banking Trojan distributed via Telegram spam that disables antivirus apps, intercepts SMS one-time codes, and exfiltrates banking credentials. The malware uses AES-encrypted assets, a custom binary protocol over sockets, and multiple modules for screen streaming, keylogging, microphone access, and remote control. Infrastructure analysis traced the payload to an S3-compatible bucket on Backblaze, four command-and-control domains, and a VPS, with the domains registered through reg.ru. Notifications sent to Backblaze resulted in account termination within 11 minutes, while reg.ru responded only after a week with a statement refusing action without a court order. The same signing certificate appears across multiple variants, allowing rapid infrastructure rotation that keeps the campaign active despite takedown attempts. Kaspersky and CERT teams were also notified but produced no visible results within the observed period.
SLEEPWALKER Backdoor Activates on Windows via Single Custom Encrypted Packet
SLEEPWALKER is a passive Windows backdoor that stays dormant in memory until it receives one specially crafted encrypted network packet. Upon activation the implant decrypts and executes custom bytecode written in a proprietary 23-instruction language, eliminating traditional beaconing and reducing network indicators. The malware is delivered as a 64-bit DLL that impersonates dpapi.dll and is loaded via DLL side-loading into ERAAgent.exe, the executable of the ESET Management Agent used in ESET PROTECT deployments. It inspects raw traffic in promiscuous mode, supports multiple transport protocols including TCP, UDP, ICMP, SMB named pipes and VMware VMCI, and can weaken security by modifying registry values such as EveryoneIncludesAnonymous and NullSessionPipes. Configuration is protected with AES-256-CCM and the sample contains no confirmed victims or attributed infrastructure. Researchers have released YARA rules and read-only scanning utilities to detect the implant and its artifacts.