{
  "family": "bedep",
  "sample_count": 3,
  "category": "ransomware",
  "description": "Backdoor:Win32/Bedep is a highly sophisticated backdoor and ad-fraud bot that gained immense notoriety as one of the primary payloads delivered by the infamous **Angler Exploit Kit**. Unlike simplistic click-fraud bots, Bedep utilizes advanced rootkit-like techniques, executing entirely in memory to evade detection while quietly enslaving the infected host into a massive, highly profitable advertising fraud network.<br><br><b>Understanding Bedep (Ad-Fraud and Botnets)</b><br>To an end-user, a Bedep infection is typically invisible. There are no ransom notes or fake AV pop-ups; the malware relies on absolute stealth to maximize the time the host remains infected. For a security analyst, Bedep is a major threat. Not only does it consume bandwidth and processing power (`T1496`) by loading hidden browser instances to click on ads, but its robust backdoor capabilities (`T1105`) mean the threat actors can (and often did) sell access to the compromised machine to other cybercriminal groups to drop ransomware or banking trojans.<br><br><b>Execution and Fileless Mechanics</b><br>Bedep is almost exclusively distributed via Drive-by Compromise (`T1189`), specifically via Exploit Kits leveraging vulnerabilities in Adobe Flash or Internet Explorer. Upon successful exploitation, Bedep executes directly in memory (`T1055`)—a 'fileless' infection. It heavily obfuscates its C2 communications and uses Domain Generation Algorithms (DGAs) (`T1568.002`) to locate its command servers. To achieve persistence, it often drops a heavily encrypted DLL and modifies the registry to load it via `explorer.exe` or `svchost.exe`. Once active, it spawns hidden Internet Explorer threads to simulate human browsing, viewing video ads, and clicking affiliate links to generate revenue for the attackers.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is resource hijacking for ad-fraud, followed by the high risk of secondary payload delivery. Host-based IoCs include anomalous, hidden `iexplore.exe` processes spawning from `svchost.exe` consuming high CPU/memory, and unexpected DLLs loaded into system processes. Network IoCs include DNS requests matching known DGA patterns and constant, low-bandwidth HTTP/HTTPS traffic to unknown ad-serving domains.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1189",
    "T1496",
    "T1055",
    "T1568.002"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1496",
      "name": "Resource Hijacking (Ad-fraud / Click-fraud)",
      "tactic": "Impact"
    },
    {
      "id": "T1189",
      "name": "Drive-by Compromise (Exploit Kits)",
      "tactic": "Initial Access"
    },
    {
      "id": "T1055",
      "name": "Process Injection (Fileless memory execution)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1568.002",
      "name": "Dynamic Resolution: Domain Generation Algorithms (DGA)",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint to sever its connection to the ad-fraud C2 network and halt the generation of illicit traffic.",
    "Capture a live memory image (RAM dump) *before* rebooting, as the core Bedep payload resides entirely in memory and is highly valuable for analysis.",
    "Run a full system scan with a reputable EDR solution to identify and remove the encrypted persistence DLLs on the disk.",
    "Ensure all endpoint operating systems and applications (especially web browsers and plugins) are fully patched to mitigate Exploit Kit vectors."
  ],
  "what_to_avoid": [
    "Do not assume the machine is clean just because a standard AV scan finds nothing; Bedep's fileless nature requires deep memory scanning.",
    "Avoid leaving unpatched software (like legacy IE or Flash) on the network, as this is the primary entry point for this threat."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}