{
  "family": "bisonal",
  "sample_count": 2,
  "category": "trojan",
  "description": "Backdoor:Win32/Bisonal is a notorious, long-standing Remote Access Trojan (RAT) heavily utilized by various Chinese-speaking Advanced Persistent Threat (APT) groups (including Tonto Team and Tick). Bisonal is primarily deployed in targeted cyber-espionage campaigns against government, military, and critical infrastructure sectors across Asia (specifically South Korea, Japan, and Russia). Its core function is to establish a covert, persistent backdoor (`T1059`) to facilitate the theft of classified data and strategic intelligence.<br><br><b>Understanding Bisonal (APT RAT)</b><br>To an end-user, the system operates completely normally. For a threat hunter, discovering a Bisonal infection indicates a highly targeted, severe breach by a sophisticated nation-state adversary. Bisonal is continually updated by its operators; newer variants (sometimes tracked as 'Bisonal.B' or 'Biob') feature improved obfuscation and custom encryption to evade network detection.<br><br><b>Execution and Evasion Strategies</b><br>Bisonal is almost exclusively deployed via spear-phishing (`T1566.001`), utilizing highly tailored lures containing malicious attachments (often exploiting legacy CVEs in Microsoft Office, like CVE-2012-0158, or using malicious macros). Upon execution, the malware typically drops a decoy document to distract the user while installing the RAT in the background. It establishes persistence by creating a Windows Service (`T1543.003`) or modifying the `Run` registry keys. Bisonal communicates with its C2 infrastructure using custom, dynamically generated protocols over HTTP or HTTPS, granting the attacker full command execution, file upload/download, and the ability to execute secondary modules (like keyloggers or credential dumpers).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is the catastrophic, long-term loss of highly sensitive and classified information. Host-based IoCs include the creation of suspicious Windows Services, anomalous executables running from `%Temp%` or `%AppData%`, and EDR alerts for known exploitation techniques originating from office applications (e.g., `winword.exe` spawning `cmd.exe`). Network IoCs require deep packet inspection to identify the custom beaconing patterns and encryption routines characteristic of Bisonal C2 traffic.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1059",
    "T1543.003",
    "T1566.001",
    "T1041"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment (Primary initial access vector)",
      "tactic": "Initial Access"
    },
    {
      "id": "T1059",
      "name": "Command and Scripting Interpreter (Providing the backdoor shell)",
      "tactic": "Execution"
    },
    {
      "id": "T1543.003",
      "name": "Create or Modify System Process: Windows Service (Establishing deep persistence)",
      "tactic": "Persistence"
    },
    {
      "id": "T1041",
      "name": "Exfiltration Over C2 Channel (Stealing classified data)",
      "tactic": "Exfiltration"
    }
  ],
  "containment_steps": [
    "Immediately isolate the compromised endpoint and assume the entire domain is compromised; engage a specialized Incident Response (IR) firm.",
    "Perform a comprehensive enterprise-wide hunt for similar malware, focusing on the specific C2 infrastructure identified on the initial host.",
    "Initiate a full credential reset for the entire organization, as the attackers likely deployed tools like Mimikatz after establishing the backdoor.",
    "Analyze email gateways and proxy logs to identify the original spear-phishing email and determine if other employees were targeted or compromised."
  ],
  "what_to_avoid": [
    "Do not attempt to remediate an APT infection by simply deleting the Bisonal executable; the actors almost certainly have secondary backdoors deployed.",
    "Avoid communicating about the incident on the compromised corporate network; assume the attackers are monitoring emails."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}