Sponsor Backdoor

The Sponsor backdoor is a malicious software (malware) designed and coded by Ballistic Bobcat. This malware obfuscates data before sending it to the Command & Control (C&C) server, employing innocuous configuration files and a modular approach to evade scans. The Sponsor backdoor, a version of PowerLess, a backdoor first documented in 2021, has been deployed mainly against organizations in Israel across various sectors including automotive, engineering, financial services, healthcare, manufacturing, media, technology, and telecommunications since 2021. This activity by Ballistic Bobcat using the Sponsor backdoor has been named the "Sponsoring Access" campaign. Ballistic Bobcat exploited Microsoft Exchange vulnerabilities, often opportunistically, in the Sponsoring Access campaign. The group deployed batch files to victims' systems moments before deploying the Sponsor backdoor. These tactics have been frequently used by Ballistic Bobcat for over two years, alongside open-source tools on compromised systems. There's a clear pattern in tool development as Ballistic Bobcat and Sponsor backdoor campaigns overlap. The Sponsor backdoor uses configuration files stored on disk, dropped by batch files, both of which are innocuous so as to bypass scanning engines. ESET researcher Adam Burgher noted this modular approach is one that Ballistic Bobcat has used quite often with modest success in the past two and a half years. As of the latest report, the Sponsor backdoor has been deployed to at least 34 victims in Brazil, Israel, and the United Arab Emirates.