BendyBear

BendyBear is a sophisticated x64 shellcode malware that requires loader or code injection for deployment. It contains advanced features not typically found in shellcode, making it a potent threat to computer systems. BendyBear, along with other specific malware strains such as Bifrose, SpiderPig, and WaterBear, has been used to target various operating systems including Windows, Linux, and FreeBSD. The threat actor behind these attacks uses custom, regularly updated malware and remote access trojans like BendyBear, FakeDead, and FlagPro, employing dual-use tools and living-off-the-land tactics, such as disabling logging on routers, to conceal their operations. In comparison to other malwares like WaterBear, BendyBear does not implement API hooking, a technique used by malware to alter the behavior of APIs, thus evading detection. Both BendyBear and WaterBear use a modified RC4 encryption, however, they implement it slightly differently. Unlike WaterBear, which can filter or hide network traffic and processes via API hooking, BendyBear does not support this capability, indicating different operational strategies between the two malwares. The advisory has attributed a wide range of backdoors to BendyBear, including BIFROSE (aka Bifrost), Consock, KIVARS, PLEAD, TSCookie (aka FakeDead), XBOW, and WaterBear (aka DBGPRINT). Custom malware families used by the group include BendyBear, Bifrose, BTSDoor, FakeDead (a.k.a. TSCookie), FlagPro, FrontShell (FakeDead’s downloader module), IconDown, PLEAD, SpiderPig, SpiderSpring, SpiderStack, WaterBear. The group also utilizes Windows utilities for its own purposes - a technique known as "living off the land."