Sdbot

SDBot is a malicious software, or malware, that has been leveraged by threat actors known as TA505 and CL0P to exploit vulnerabilities in computer systems. It is used as a backdoor to enable the execution of commands and functions in the compromised computer, often without the user's knowledge. The malware can infect systems through suspicious downloads, emails, or websites, and once inside, it can steal personal information, disrupt operations, or even hold data hostage for ransom. SDBot also has the capability to drop copies of itself in removable drives and network shares, further propagating the infection. In 2019, TA505 actors used SDBot as part of a phishing campaign involving a macro-enabled document. This campaign utilized a Get2 malware dropper to download SDBot and another malware called FlawedGrace. These actors have a sophisticated toolkit that includes other malware such as FlawedAmmyy/FlawedGrace RAT, SDBot RAT, and Truebot downloader module, allowing them to collect sensitive information and spread their malware extensively. Organizations should be particularly aware of SDBot due to its association with Clop ransomware. CL0P actors use SDBot for application shimming for persistence and to avoid detection. They also use it as a backdoor to enable other commands and functions to be executed in the compromised computer. Furthermore, SDBot has been observed delivering Clop as the final payload, highlighting the potential severity of an SDBot infection. Therefore, understanding and mitigating against SDBot is crucial to preventing the deployment of Clop ransomware.