Bazaloader

BazaLoader is a type of malware, malicious software designed to exploit and damage computers or devices. It was typically distributed through email campaigns by threat actors such as TA578, who also used it to deliver other types of malware including Ursnif and IcedID. BazaLoader was last observed in Proofpoint data in February 2022, after which several threat actors transitioned to using a new malware loader called Bumblebee. This transition was noted by Google's Threat Analysis Group (TAG) in March 2022. Bumblebee has been active since March 2022, replacing BazaLoader and IcedID in the arsenals of multiple crimeware threat actors. The malware has been used in various campaigns, including those targeting Facebook users, and facilitating infection chains for LockBit ransomware and BazaLoader malware. Interestingly, BazaLoader's connection to these operations is subtler, with the group also observed using leaked Conti code, prompting further analysis and confirmation of Conti connections, as well as TrickBot and BazaLoader. In an attempt to curb the spread of such malware, steps were taken in February 2022 to prevent threat actors from delivering Emotet, TrickBot, and Bazaloader using certain vectors. Despite this, some groups have continued their malicious activities, employing tactics like the BazaCall phishing campaign, where unsuspecting users are tricked into phoning the attacker and coached into downloading BazaLoader malware. This then retrieves and installs a remote monitoring and management (RMM) tool onto the user’s device.