Security Experts:

Connect with us

Hi, what are you looking for?


Malware & Threats

Well-Funded Threat Group Targets Asian Firms

A well-funded and well-organized threat group that focuses its activities on Asian companies has been using Bifrose code to develop its own backdoors, Trend Micro reported on Thursday.

A well-funded and well-organized threat group that focuses its activities on Asian companies has been using Bifrose code to develop its own backdoors, Trend Micro reported on Thursday.

Bifrose, also known as Bifrost, is a piece of malware that has been around since at least September 2008. In September 2014, researchers reported seeing a new version of Bifrose, one that used the Tor network for command and control (C&C) communications, being used in targeted attacks.

In the past, the Bifrose source code was sold on the underground market for as much as $10,000. Researchers at Trend Micro believe a threat actor that has been active since at least 2010 acquired the Bifrose source code and used it to create other backdoors.

“Our research indicates that the group has sufficient financial resources to purchase the source code of a widely available malware tool, and the human resources to design improved versions of its own backdoors based on this,” Trend Micro threats analyst Razor Huang explained.

According to the security firm, the APT actor likely purchased the Bifrose source code, improved its functions, designed a new installation flow, created a new builder, and made its backdoor capabilities simpler and more concise. The result was a new backdoor that became known as Kivars, a threat that is capable of targeting 64-bit systems since mid-2014.

The malware, which has been used by the threat group since 2010, allows attackers to download and upload files, take screenshots, log keystrokes, manipulate active windows, and execute mouse and keyboard actions.

Trend Micro linked Bifrose to Kivars based on several clues, including the format of the initial message sent to the C&C server, and program database (PDB) paths in Kivars containing the string “BR,” likely a reference to Bifrose RAT.

Another backdoor developed by the threat actor based on Bifrose has been dubbed Xbow. The malware, which has been used since mid-2010, contains folder paths that are similar to Bifrose and Kivars, and some variants include functionality that is also present in Bifrose.

The operation monitored by Trend Micro, dubbed Shrouded Crossbow, has focused on Asian government contractors, privatized government agencies, and companies in the financial, healthcare, computer and consumer electronics sectors.

Based on mutexes created by Xbow and other evidence, the security firm believes the threat group has separate teams for each activity. One team, which has at least 10 members, is responsible for developing the malware. Another team is in charge of infiltrating the targeted organizations via spear-phishing emails that contain malicious attachments.

A third team is believed to be in charge of maintaining the group’s extensive C&C infrastructure. Experts have uncovered more than 100 C&C server and the attackers keep expanding it with new domains.

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Expert Insights

Related Content

Malware & Threats

Microsoft plans to improve the protection of Office users by blocking XLL add-ins from the internet.


Chinese threat actor DragonSpark has been using the SparkRAT open source backdoor in attacks targeting East Asian organizations.

Malware & Threats

Norway‎-based DNV said a ransomware attack on its ship management software impacted 1,000 vessels.


CISA, NSA, and MS-ISAC issued an alert on the malicious use of RMM software to steal money from bank accounts.

Application Security

Electric car maker Tesla is using the annual Pwn2Own hacker contest to incentivize security researchers to showcase complex exploit chains that can lead to...

Malware & Threats

Cybercrime in 2017 was a tumultuous year "full of twists and turns", with new (but old) infection methods, a major return to social engineering,...

Malware & Threats

Fortinet warned of three malicious PyPI packages containing code that fetches the Wacatac trojan and information stealer.


The recent ransomware attack targeting Rackspace was conducted by a cybercrime group named Play using a new exploitation method, the cloud company revealed this...