June 2, 2020 By David Bisson 2 min read

Security researchers observed the Trickbot operators using a new backdoor called “BazarBackdoor” to gain full access to targeted networks.

Panda Security explained that Trickbot’s attempts to deliver BazarBackdoor began with a spear phishing campaign. That operation’s attack emails leveraged employee termination notices, customer complaints and other themes to trick recipients into clicking on a link for a file hosted on Google Docs. The links redirected victims to a website that informed the recipient that they needed to download the file directly in order to view it correctly.

When downloaded, the documents ran hidden executable code to call a loader. This asset remained quiet for a time before connecting with a command-and-control (C&C) server for the purpose of downloading BazarBackdoor. This malware shared parts of the same code along with delivery and operation methods employed by Trickbot, similarities that led Panda Security to speculate that the same actors were responsible for developing both threats.

Trickbot’s Activity Involving Other Backdoors

BazarBackdoor didn’t mark the first time that Trickbot has leveraged a backdoor in its attack efforts. Back in April 2019, Cybereason detected an attack campaign in which Emotet loaded Trickbot as a means to deploy Ryuk ransomware. In that attack, Trickbot used its reverse shell module, “dll.dll,” to perform reconnaissance so that it could eventually launch the Empire backdoor. In January 2020, Sentinel Labs observed Trickbot using “PowerTrick,” a backdoor that helped the malware conduct reconnaissance of and remain persistent on the networks of targeted financial institutions.

Defend Against BazarBackdoor

Security professionals can help defend their organizations against phishing attacks carrying BazarBackdoor by making sure that there’s an incident response (IR) plan in place that provides guidance on how to remediate a successful phishing attack. Having a plan is not enough; teams should also regularly test this strategy to ensure the plan works ahead of an attack. Additionally, infosec personnel should leverage ongoing phishing simulations to strengthen their employees’ defenses against email attacks.

More from

Bypassing Windows Defender Application Control with Loki C2

10 min read - Windows Defender Application Control (WDAC) is a security solution that restricts execution to trusted software. Since it is classified as a security boundary, Microsoft offers bug bounty payouts for qualifying bypasses, making it an active and competitive field of research.Typical outcomes of a WDAC bypass bug bounty submission:Bypass is fixed; possible bounty awardedBypass is not fixed but instead "mitigated" by being added to the WDAC recommended block list. Likely no bounty awarded but honorable mention is typically givenBypass is not…

FYSA — VMware Critical Vulnerabilities Patched

< 1 min read - SummaryBroadcom has released a security bulletin, VMSA-2025-0004, addressing and remediating three vulnerabilities that, if exploited, could lead to system compromise. Products affected include vCenter Server, vRealize Operations Manager, and vCloud Director.Threat TopographyThreat Type: Critical VulnerabilitiesIndustry: VirtualizationGeolocation: GlobalOverviewX-Force Incident Command is monitoring activity surrounding Broadcom’s Security Bulletin (VMSA-2025-0004) for three potentially critical vulnerabilities in VMware products. These vulnerabilities, identified as CVE-2025-22224, CVE-2025-22225, and CVE-2025-22226, have reportedly been exploited in attacks. X-Force has not been able to validate those claims. The vulnerabilities…

SoaPy: Stealthy enumeration of Active Directory environments through ADWS

10 min read - Introduction Over time, both targeted and large-scale enumeration of Active Directory (AD) environments have become increasingly detected due to modern defensive solutions. During our internship at X-Force Red this past summer, we noticed FalconForce’s SOAPHound was becoming popular for enumerating Active Directory environments. This tool brought a new perspective to Active Directory enumeration by performing collection via Active Directory Web Services (ADWS) instead of directly through Lightweight Directory Access Protocol (LDAP) as other AD enumeration tools had in the past.…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today