BONDUPDATER

MITRE ATT&CK: S0360 View on attack.mitre.org

Aliases: Glimpse, Poison Frog, BONDUPDATER

First seen
2017-11-01 00:00:00
Malware type
backdoor
Family
Malware family
Operating systems
windows
Profile updated
2026-07-07 12:48:55

Targeted industries: government-and-public-sector

Targeted regions: country_code:sa

Context

BONDUPDATER is a PowerShell backdoor used by OilRig. It was first observed in November 2017 during targeting of a Middle Eastern government organization, and an updated version was observed in August 2018 being used to target a government organization with spearphishing emails.

Detection coverage

  • 327 Sigma rules

Malware & tools used

  • Windows Command Shell (attack-pattern)
  • Hidden Window (attack-pattern)
  • DNS (attack-pattern)
  • Scheduled Task (attack-pattern)
  • Domain Generation Algorithms (attack-pattern)
  • Ingress Tool Transfer (attack-pattern)
  • PowerShell (attack-pattern)

Used by threat actors

Reports & references

  • Palo Alto Unit 42 — Unit42 Oilrig Uses Updated Bondupdater Target Middle Eastern Government (report)
  • Mandiant — Targeted Attack In Middle East By Apt34 (report)
  • secureworks.com — Cobalt Gypsy (report)
  • ti.qianxin.com — Cb78386A082F465F259B37Dae5Df4884 (report)
  • cyware.com — Apt34 The Helix Kitten Cybercriminal Group Loves To Meow Middle Eastern And International Organizations 48Ae (report)
  • zdnet.com — Source Code Of Iranian Cyber Espionage Tools Leaked On Telegram (report)
  • malpedia.caad.fkie.fraunhofer.de — Ps1.Bondupdater (report)
  • boozallen.com — Dark Labs Discovers Apt34 Malware Variants (report)
  • Palo Alto Unit 42 — Dns Tunneling In The Wild Overview Of Oilrigs Dns Tunneling (report)
  • nsfocusglobal.com — Apt34 Event Analysis Report (report)
  • marcoramilli.com — Apt34 Glimpse Project (report)
  • researchcenter.paloaltonetworks.com — Unit42 Oilrig Uses Updated Bondupdater Target Middle Eastern Government (report)
  • netscout.com — Tunneling Under Sands (report)
  • blog.0day.rocks — Hacking Back And Influence Operations 85Cd52C1E933 (report)
  • Palo Alto Unit 42 — Behind The Scenes With Oilrig (report)
  • ironnet.com — Chirp Of The Poisonfrog (report)
  • MITRE ATT&CK — S0360 (report)

External references