Bazar

"Bazar" is a form of malware, a malicious software designed to exploit and damage computer systems. This harmful program can infiltrate systems via suspicious downloads, emails, or websites, often unbeknownst to the user. Once it gains access, it can steal personal information, disrupt operations, or even hold data hostage for ransom. Bazar has different components known by the cybersecurity community as BazaLoader, BazarLoader, and BazarBackdoor. It disguises itself using a DLL that appears as a jpg file and utilizes HTTPS C2 throughout the intrusion process. The typical child processes associated with Bazar include cmd.exe, svchost.exe, explorer.exe, nltest.exe, and net.exe. Bazar has been linked to ransomware attacks, with cybercriminals increasingly deploying it in campaigns. An example of this is the Conti attack diagram, which illustrates the progression from Bazar to ransomware. These campaigns represent a new technique for cybercriminals to infect and monetize networks. One notable instance of this was the deployment of the Ryuk ransomware. The malware's operational versions are referred to as "Bazar," while its development versions are named "Team9." The threat posed by Bazar is on the rise, with partial automation enabling the scaling of cybercrime. This tactic has already been seen in Bazar campaigns, illustrating that it's not an innovation but rather a tried-and-true technique. Defenders are already grappling with this issue, as evidenced by the detection opportunity involving the enumeration of domain trusts activity with nltest.exe, which is associated with reconnaissance commands linked to Bazar. Despite these defensive efforts, the malware continues to pose a significant challenge to cybersecurity.