Full Report
Uncovering the operations of threat actor Boolka, driven by the creation of malicious scripts, malware trojans, sophisticated malware delivery platforms, and more.
Analysis Summary
# Threat Actor: Boolka
## Attribution & Identity
**Boolka** is a sophisticated threat actor characterized by their ability to develop custom malicious scripts, malware trojans, and complex delivery platforms. The actor is noted for a high degree of technical proficiency in creating multi-stage infection chains and specialized browser-focused malware.
## Activity Summary
Boolka has been observed operating a complex malware delivery and management ecosystem. Their recent operations involve the deployment of a custom suite of tools known as "Full Browser Manager," which is delivered through multi-stage loaders and exploits. The actor utilizes modular components to maintain a presence on infected systems, specifically targeting data transmitted through web browsers.
## Tactics, Techniques & Procedures
- **Multi-stage Delivery:** Use of initial loaders to fetch and execute subsequent stages of malware.
- **Persistence via Scheduled Tasks:** Creates multiple Windows tasks to ensure malware components execute upon user logon.
- **Data Exfiltration:** Capturing and transmitting system information and browser-related data to C2 nodes.
- **Browser Hooking:** Using specialized components (like `bmhook.exe`) to intercept browser activity.
- **Dynamic C2 Communication:** Use of "main nodes" to manage and distribute commands to sub-nodes.
**MITRE ATT&CK IDs:**
- **T1053.005:** Scheduled Task/Job: Scheduled Task
- **T1547.001:** Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder (implied by logon tasks)
- **T1071.001:** Application Layer Protocol: Web Protocols
- **T1059:** Command and Scripting Interpreter
- **T1005:** Data from Local System
## Targeting
- **Sectors:** The provided data indicates a focus on broad information theft, suggesting targeting of any sector where sensitive web-based credentials or data are processed.
- **Geography:** Global, though specific regional targeting was not detailed in the provided snippets.
- **Victims:** General internet users and organizations relying on web-based workflows.
## Tools & Infrastructure
### Malware Families
- **BMANAGER:** The primary component of the "Full Browser Manager" suite.
- **BMHOOK, BMLOG, BMREADER, BMBACKUP:** Modular components of the browser management suite.
- **BeEF (Browser Exploitation Framework):** Integrated into their infrastructure for browser-based attacks.
### Infrastructure (Defanged)
- hxxps[://]mainnode[.]beonlineboo[.]com
- hxxps[://]node[.]beonlineboo[.]com
- hxxps[://]updatebrower[.]com/download/
- hxxp[://]boolka[.]tk
- hxxps[://]beef[.]beonlineboo[.]com
- hxxps[://]beonlineboo[.]com
- hxxps[://]boolka24[.]tk
## Implications
Boolka represents a highly organized threat that moves beyond simple commodity malware. Their development of a dedicated "Browser Manager" suite suggests a long-term strategic interest in persistent access to web sessions, potentially for financial fraud, credential harvesting, or corporate espionage. Their use of modular infrastructure makes them resilient to simple domain blocking.
## Mitigations
- **Monitor Scheduled Tasks:** Implement alerts for the creation of unusual scheduled tasks, particularly those running from `Program Files` or `AppData` with names like `bmanager` or `bmhook`.
- **Endpoint Protection:** Use EDR/AV solutions to detect and block the execution of unsigned binaries in `C:\Program Files\Full Browser Manager\`.
- **Network Filtering:** Block communication with the known `beonlineboo[.]com` and `updatebrower[.]com` domains at the firewall or proxy level.
- **Browser Security:** Encourage the use of hardened browser configurations and monitor for unauthorized browser extensions or unexpected hooking behaviors.