DanBot

DanBot is a malicious software (malware) written in C# using .NET Framework 2.0 that provides basic remote access capabilities. It was identified as part of the arsenal used by the cyber threat group, OilRig, and has been linked to other backdoors such as Solar, Shark, Milan, and Marlin. The malware is designed to infiltrate systems through suspicious downloads, emails, or websites, often without user knowledge. Once inside, it can steal personal information, disrupt operations, or even hold data hostage for ransom. In 2021, OilRig updated its DanBot backdoor and began deploying additional backdoors like Shark, Milan, and Marlin as per the ESET Threat Report T3 2021. The DanBot variant operated by LYCEUM, another cyber threat group, hosted multiple command and control (C2) domains, indicating its widespread use in cyber espionage. Some of the Milan backdoors analyzed also included samples that were clustered as DanBot backdoors, further confirming its broad deployment in cyber attacks. The DanBot malware shares several similarities with other backdoors used in cyber operations, particularly in terms of upload and download schemes for communicating with the C&C server. Both Solar and Shark backdoors, for instance, use URIs with simple upload ("u") and download ("d") schemes. Additionally, the downloader SC5k uses uploads and downloads subdirectories akin to other OilRig backdoors like ALMA, Shark, DanBot, and Milan. This overlap in tools and targeting highlights the interconnected nature of these cyber threats and their shared methodologies.