Bisonal Malware Used in Attacks Against Russia and South Korea
Summary: Unit 42 discovered an attack campaign in early May against at least one defense company in Russia and one unidentified organization in South Korea, delivering a Bisonal malware variant that has been in the wild since at least 2014. The variant differs from older Bisonal in its RC4 cipher for C2 communication, a rewritten network communication and persistence code, and only 14 samples collected to date.
What you should know: The Russian target develops encryption and secure communication products, and the spear-phishing email was spoofed to look like it came from Rostec, a Russian state corporation, to exploit an existing relationship with the target. With only 14 samples of this variant seen since 2014, the actors are using it sparingly, which makes detection harder for defenders relying on volume-based signatures.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026