Threat Group Cards: A Threat Actor Encyclopedia
Archived: 2026-04-05 16:20:51 UTC
Home > List all groups > List all tools > List all groups using tool BazarBackdoor
 Tool: BazarBackdoor
Names
BazarBackdoor
BazarLoader
BEERBOT
BazarCall
KEGTAP
Team9Backdoor
bazaloader
Category Malware
Type Backdoor, Downloader
Description
(BleepingComputer) After a victim launches the downloaded file, the loader will sleep for a
short period of time and then connect to command and control servers to check-in and
download the backdoor payload.
To get the address of the command and control servers, BazarLoader will use the Emercoin
decentralized DNS resolution service to resolve various hostnames that use the 'bazar' domain.
The 'bazar' domain can only be utilized on Emercoin's DNS servers, and as it is decentralized,
it makes it difficult, if not impossible, for law enforcement to seize the hostname.
After the payload is downloaded, it will be filelessly injected into the
C:\Windows\system32\svchost.exe process. Security researcher Vitali Kremez told
BleepingComputer that this is done using the Process Hollowing and Process Doppelgänging
techniques.
After a period of time, both Kremez and James have told BleepingComputer that the backdoor
will download and execute the Cobalt Strike penetration testing and post-exploitation toolkit
on the victim's machine.
Information https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=45260893-fa7b-4738-aecd-7d6ad6cc1577
Page 1 of 3

Malpedia Last change to this tool card: 18 November 2022
Download this tool card in JSON format
All groups using tool BazarBackdoor
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=45260893-fa7b-4738-aecd-7d6ad6cc1577
Page 2 of 3

Changed Name Country Observed
APT groups
  FIN12 [Unknown] 2018  
  Wizard Spider, Gold Blackburn 2014-May 2025
Other groups
  UNC1878 [Unknown] 2020  
3 groups listed (2 APT, 1 other, 0 unknown)
Source: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=45260893-fa7b-4738-aecd-7d6ad6cc1577
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=45260893-fa7b-4738-aecd-7d6ad6cc1577
Page 3 of 3