Forest Global Training Partners

Cyber Risks · Cisco Talos

Bisonal: 10 years of play

Summary: Cisco Talos traces the Bisonal malware back roughly a decade, linking it to the Tonto Team arsenal and to campaigns that used Hangul Word Processor decoy documents against South Korean political parties, media, a national policy research institute, a military branch and government branches, plus Russian-language decoys including one alleged to be from Rostec. The analyzed samples communicate with command-and-control servers through dynamic DNS domains such as young03[.]myfw[.]us on port 8888, send the hostname and the string "kris0315" unencrypted over raw sockets, and support only three commands, while later variants add proxy support, Cyrillic code pages and file exfiltration.

What you should know: A toolset that has run for ten years against government, defense and media targets still ships with hardcoded Cyrillic code pages and a User-Agent typo carried since 2014, so the same infrastructure patterns - dynamic DNS C2 and unencrypted hostname beacons - remain the detection opportunity.

Read the original at Cisco Talos ↗

Topics
Malware
Related