BONDUPDATER

MITRE ATT&CK: S0360 View on attack.mitre.org

Aliases: Glimpse, Poison Frog, BONDUPDATER

First seen
2017-11-01 00:00:00
Malware type
backdoor
Family
Malware family
Operating systems
windows
Related IoCs
6 (6 malicious)
Last IoC activity
2026-10-10 15:41:08
Profile updated
2026-07-07 12:48:55

Targeted industries: government-and-public-sector

Targeted regions: country_code:sa

Context

BONDUPDATER is a PowerShell backdoor used by OilRig. It was first observed in November 2017 during targeting of a Middle Eastern government organization, and an updated version was observed in August 2018 being used to target a government organization with spearphishing emails.

Recent IoC activity

6 malicious indicators in Maltiverse are attributed to BONDUPDATER (S0360). The 6 most recently updated:

TypeIndicatorUpdatedSources
file sample 79f55e1d0ae8ba9f9a0c210578ff2a100f9a9e6839a4e829986c5579162d94b0 2026-10-18 1
file sample f5a64de9087b138608ccf036b067d91a47302259269fb05b3349964ca4060e7e 2026-10-18 1
URL http://go0gie.com/sysupdate.aspx?req=989071099%5Cdwn&m=d 2026-10-10 1
URL http://go0gie.com/sysupdate.aspx?req=989071099%5Cbat&m=d 2026-10-10 1
hostname 00000000tma30.go0gie.com 2026-10-10 1
hostname go0gie.com 2026-10-10 1

Detection coverage

  • 327 Sigma rules

Malware & tools used

  • Windows Command Shell (attack-pattern)
  • Hidden Window (attack-pattern)
  • DNS (attack-pattern)
  • Scheduled Task (attack-pattern)
  • Domain Generation Algorithms (attack-pattern)
  • Ingress Tool Transfer (attack-pattern)
  • PowerShell (attack-pattern)

Used by threat actors

Reports & references

  • Palo Alto Unit 42 — Unit42 Oilrig Uses Updated Bondupdater Target Middle Eastern Government (report)
  • Mandiant — Targeted Attack In Middle East By Apt34 (report)
  • secureworks.com — Cobalt Gypsy (report)
  • ti.qianxin.com — Cb78386A082F465F259B37Dae5Df4884 (report)
  • malpedia.caad.fkie.fraunhofer.de — Ps1.Bondupdater (report)
  • boozallen.com — Dark Labs Discovers Apt34 Malware Variants (report)
  • Palo Alto Unit 42 — Dns Tunneling In The Wild Overview Of Oilrigs Dns Tunneling (report)
  • nsfocusglobal.com — Apt34 Event Analysis Report (report)
  • marcoramilli.com — Apt34 Glimpse Project (report)
  • researchcenter.paloaltonetworks.com — Unit42 Oilrig Uses Updated Bondupdater Target Middle Eastern Government (report)
  • netscout.com — Tunneling Under Sands (report)
  • blog.0day.rocks — Hacking Back And Influence Operations 85Cd52C1E933 (report)
  • Palo Alto Unit 42 — Behind The Scenes With Oilrig (report)
  • ironnet.com — Chirp Of The Poisonfrog (report)
  • cyware.com — Apt34 The Helix Kitten Cybercriminal Group Loves To Meow Middle Eastern And International Organizations 48Ae (report)
  • zdnet.com — Source Code Of Iranian Cyber Espionage Tools Leaked On Telegram (report)
  • MITRE ATT&CK — S0360 (report)

External references