{
  "family": "bandoo",
  "sample_count": 11,
  "category": "advanced_threat",
  "description": "Adware:Win32/Bandoo is a highly aggressive adware framework, Browser Hijacker, and Potentially Unwanted Program (PUA) that was notoriously prevalent in the early 2010s. Marketed deceptively as a tool to add 'emoticons' and 'winks' to email and chat clients (like Windows Live Messenger or Yahoo Messenger), it silently hijacked browser settings and flooded the user with intrusive advertisements.<br><br><b>What is Bandoo?</b><br>To the average user, Bandoo was highly visible and incredibly difficult to remove. While it did provide the promised emoticons, the true cost was the total subversion of their web browsing experience. The browser homepage was forcibly changed to Bandoo Search (or its affiliates), default search engines were locked, and standard websites were flooded with injected banner ads. For security analysts, Bandoo was a textbook example of aggressive Pay-Per-Install (PPI) adware. It leveraged deceptive installation tactics and deep system integration to ensure the user could not easily revert their settings.<br><br><b>Infection Vectors & Threat Hunting</b><br>Bandoo was distributed via its own website and bundled aggressively with freeware on download portals. When a user installed the emoticon pack, the Bandoo wrapper executed (`T1204.002`). It installed a massive, unwanted browser toolbar (`T1176`) and modified critical browser preference files (`T1112`). It established persistence via multiple Registry Run keys, BHOs (Browser Helper Objects), and often installed a watchdog Windows Service to instantly reinstall the toolbar if the user attempted to delete it (`T1543.003`).<br><br><b>Forensic Analysis & Impact</b><br>The primary impact was a severely degraded user experience, compromised browsing privacy (all searches were tracked), and a sluggish system due to the heavy toolbar overhead. Incident responders would observe anomalous HTTP/HTTPS traffic to Bandoo's ad networks. EDR logs would flag the constant modification of browser registry keys and the presence of Bandoo-related DLLs injected into `iexplore.exe` or `chrome.exe`.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1189",
    "T1562.001",
    "T1176",
    "T1112",
    "T1543.003"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1189",
      "name": "Drive-by Compromise (Bundled Installers)",
      "tactic": "Initial Access"
    },
    {
      "id": "T1176",
      "name": "Browser Extensions (Toolbar Installation)",
      "tactic": "Persistence"
    },
    {
      "id": "T1112",
      "name": "Modify Registry (Search Hijacking)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1543.003",
      "name": "Create or Modify System Process: Windows Service",
      "tactic": "Persistence"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Quarantine the endpoint to halt the active exfiltration of browsing telemetry and the display of malvertising.",
    "Use the Windows Control Panel to thoroughly uninstall the 'Bandoo Media Inc.' software and any associated toolbars.",
    "Deploy an enterprise adware removal tool (e.g., AdwCleaner) to locate and strip the deeply embedded registry hooks, BHOs, and watchdog services.",
    "Force a complete reset of all installed web browsers to factory defaults to eradicate the rogue extensions and restore the homepage."
  ],
  "what_to_avoid": [
    "Do not rely solely on the browser's 'remove extension' button; Bandoo uses services and BHOs to immediately reinstall itself upon reboot.",
    "Avoid ignoring the infection; adware tracking data is highly detailed and may expose corporate activities."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}