BazarLoader / BazarBackdoor (also known as BazarLoader, BazarBackdoor, BazarCall) is a malware loader active since 2020. TrickBot successor loader. Key characteristics include: enterprise targeting, call-back phishing (BazarCall), Conti/Ryuk delivery, TrickBot evolution.
Overview & Background
TrickBot successor loader. First identified in 2020, this threat is attributed to Wizard Spider.
BazarLoader remains an active threat. Organizations should implement detection rules and monitor for indicators associated with this malware loader.
- Category: Malware Loader
- Active since: 2020
- Attribution: Wizard Spider
- Also known as: BazarLoader, BazarBackdoor, BazarCall
Technical Analysis
BazarLoader employs the following capabilities and techniques:
- Enterprise Targeting: Core functionality
- Call-Back Phishing (Bazarcall): Core functionality
- Conti/Ryuk Delivery: Core functionality
- Trickbot Evolution: Core functionality
MITRE ATT&CK Mapping
| Tactic | Technique | Usage |
|---|---|---|
| Initial Access | T1566.001 Phishing Attachment | Common delivery vector |
| Execution | T1204.002 Malicious File | User-triggered execution |
| Persistence | T1547.001 Registry Run Keys | Autostart persistence |
| Defense Evasion | T1027 Obfuscated Files | Payload obfuscation |
| C2 | T1071.001 Web Protocols | HTTP/HTTPS C2 |
Detection & Defense
- Endpoint detection: Deploy behavioral detection rules for BazarLoader indicators
- Network monitoring: Monitor for C2 traffic patterns and anomalous connections
- Threat intelligence: Track BazarLoader IOCs and campaign updates
- Security awareness: Train users to recognize phishing and social engineering
- Patch management: Keep systems updated to prevent exploitation
Defend Against BazarLoader
Mjolnir Security provides detection and response capabilities against BazarLoader and similar threats.
- Proactive Threat Hunting Hunt for BazarLoader indicators and TTPs within your environment.
- Threat Intelligence Monitor BazarLoader campaigns and infrastructure changes.
- 24/7 Incident Response Rapid containment and forensic investigation. Call +1 833 403 5875.
Stay ahead of emerging threats. Get notified when we publish new intelligence reports and advisories.
Subscribe to Alerts