{
  "family": "bomka",
  "sample_count": 1,
  "category": "ransomware",
  "description": "<h3>Executive Summary</h3>\nBomka is a family of Adware and Potentially Unwanted Programs (PUPs) engineered to aggressively monetize an infected user's web browsing activity. By forcefully altering browser configurations and injecting highly intrusive advertisements, Bomka degrades system performance, disrupts workflows, and poses a significant threat to end-user privacy within enterprise environments.\n\n<h3>Distribution and Technical Behavior</h3>\nBomka is almost exclusively distributed via deceptive software bundling. It is frequently hidden within \"free\" software installers, fake software updates, or media players downloaded from untrustworthy, third-party software portals.\n\nOnce executed, Bomka deeply integrates with the operating system and installed web browsers (Google Chrome, Firefox, Edge). Its core behaviors include:\n<ul>\n<li><strong>Browser Hijacking:</strong> Bomka forcefully alters the browser's default search engine, homepage, and new tab settings. All search traffic is redirected through an affiliate-linked search portal controlled by the adware operators to generate illicit ad revenue.</li>\n<li><strong>Traffic Interception and Injection:</strong> The software frequently installs malicious browser extensions or a local proxy server to intercept unencrypted web traffic, overlaying legitimate websites with pop-ups, pop-unders, banner ads, and sponsored in-text hyperlinks.</li>\n<li><strong>Data Harvesting:</strong> It continuously tracks the user's browsing history, search queries, and clickstreams, transmitting this telemetry to remote servers to serve highly targeted advertisements.</li>\n</ul>\n\n<h3>Risk Assessment</h3>\nWhile Bomka does not actively encrypt files or steal credentials like a banking trojan, it introduces massive operational friction. Furthermore, the injected advertisements are frequently served by low-reputation ad networks, dramatically increasing the likelihood of \"malvertising\" attacks that can lead to severe secondary infections, such as ransomware or info-stealers.\n\n<h3>Mitigation and Removal Strategies</h3>\n<ul>\n<li><strong>Endpoint Scanning:</strong> Utilize a reputable enterprise-grade anti-malware solution to perform a deep system scan, targeting the Bomka executables, hidden scheduled tasks, and persistent registry keys used to maintain its hold on the browser.</li>\n<li><strong>Browser Remediation:</strong> Manually inspect and remove any unknown or unauthorized extensions from all installed web browsers. Perform a complete factory reset of the browsers to clear the hijacked proxy and search settings.</li>\n<li><strong>Application Control:</strong> Enforce strict application whitelisting policies to prevent standard users from executing unapproved software installers that are the primary vector for this adware.</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Adware.Bomka",
    "PUP.Bomka",
    "BrowserModifier:Win32/Bomka"
  ],
  "enrichment_level": "insufficient_information",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1566.002",
    "T1176",
    "T1112"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-01T16:42:48Z",
  "type": "Adware",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}