Bazaloader

BazaLoader is a type of malware, malicious software designed to infiltrate and damage computer systems, often without the user's knowledge. It is typically distributed through suspicious downloads, emails, or websites, and once inside a system, it can steal personal information, disrupt operations, or hold data hostage for ransom. BazaLoader was notably used in phishing campaigns that tricked unsuspecting users into phoning the attacker, who then guided them into downloading the malware. This malware would subsequently retrieve and install a remote monitoring and management (RMM) tool onto the user’s device. Several threat actors known for using BazaLoader in their malware campaigns have transitioned to a new malware loader called Bumblebee. This transition was observed by Proofpoint, with BazaLoader last appearing in their data in February 2022. At least three tracked threat actors that previously distributed BazaLoader have shifted to Bumblebee payloads. Additionally, TA578, a threat actor that has previously used email to deliver malware such as Ursnif, BazaLoader, and IcedID, is among those monitored. In response to the increasing threat from malware like BazaLoader, tech giants took steps to prevent these harmful programs' delivery. In February 2022, Microsoft disabled a vector frequently weaponized by threat actors to deliver malware, including Emotet, TrickBot, and BazaLoader. Despite these efforts, some groups continue to subtly use BazaLoader, as observed in the case of Lockbit, which also uses leaked Conti code. The connection between these groups prompted further analysis, confirming links with Conti, TrickBot, and BazaLoader.