Bazarbackdoor

BazarBackdoor is a type of malware developed by ITG23, first identified in April 2020. It is commonly distributed via contact forms on corporate websites, bypassing regular phishing emails, which makes it harder to detect. The malware is often associated with BazarLoader, both of which were used extensively by actors linked to the TrickBot network to infiltrate victim systems starting from early 2020. In February 2022, the Conti ransomware group took over the TrickBot operation and planned to replace it with BazarBackdoor. This transition came after several unsuccessful takedown attempts by the U.S. government. The Conti group enhanced the development of more advanced and stealthy malware such as BazarBackdoor and Anchor, with BazarBackdoor being employed for initial access to networks due to increased detection of TrickBot by anti-malware solutions. Before its dissolution in mid-2022, the Conti group launched a new subgroup called Karakurt. This subgroup focused on data extortion rather than crypto-locking files. It used the BazarLoader dropper to infect systems, install BazarBackdoor, and provide remote access to these systems to Karakurt. This allowed them to steal data and extort victims. The core team of TrickBot developers had created BazarBackdoor, a stealthier malware, to gain remote access into corporate networks and deploy ransomware.