{
  "family": "bolik",
  "sample_count": 1,
  "category": "trojan",
  "description": "<h3>Executive Summary</h3>\nBolik is a highly sophisticated Banking Trojan that emerged around 2016. Security researchers consider it a direct, advanced descendant of the infamous Zeus and Carberp banking trojans, as it shares significant portions of their leaked source code. Bolik is designed for high-end financial fraud, engineered to stealthily harvest banking credentials, intercept two-factor authentication (2FA) tokens, and execute unauthorized wire transfers from compromised corporate endpoints.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nBolik is typically distributed through highly targeted spear-phishing campaigns (often disguised as B2B invoices or tax documents) containing weaponized Office documents, or via drive-by downloads from compromised websites (often utilizing the RIG Exploit Kit).\n\nUpon execution, Bolik demonstrates advanced, modular capabilities:\n<ul>\n<li><strong>Web Injection (Man-in-the-Browser):</strong> Bolik's primary weapon is its web injection engine. When a victim logs into a targeted banking portal (e.g., Chase, Barclays), the trojan intercepts the browser traffic (Internet Explorer, Chrome, Firefox) and injects fraudulent HTML/JavaScript into the page. This allows attackers to steal login credentials, prompt for 2FA codes, or hide the true account balance.</li>\n<li><strong>Reverse Connect (VNC) and Web-Proxy:</strong> The trojan establishes a reverse VNC connection, giving the attacker hidden, interactive access to the victim's desktop. It also sets up a local web proxy, allowing the attacker to route their fraudulent transactions through the victim's IP address, bypassing bank geolocation security checks.</li>\n<li><strong>Fileless Evasion:</strong> Bolik heavily utilizes process hollowing and DLL injection (often targeting `explorer.exe` or `svchost.exe`) to execute its core payload directly in memory, making it highly resistant to traditional disk-based antivirus scanning.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Bolik infection is a critical security incident. Because it specifically targets financial institutions and corporate banking portals, the presence of this trojan poses an immediate, severe risk of massive financial theft and corporate wire fraud.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Network Isolation:</strong> Disconnect the infected machine immediately to sever the reverse VNC connection and prevent the attacker from executing fraudulent transactions.</li>\n<li><strong>Emergency Financial Freeze:</strong> Notify the corporate treasury or finance department immediately. All banking credentials utilized on the infected machine must be frozen, and recent wire transfers must be audited for fraud.</li>\n<li><strong>Volumetric Memory Analysis:</strong> Because Bolik operates largely filelessly, responding to the incident requires volatile memory (RAM) capture and analysis using advanced EDR tools to identify the injected processes and extract the specific banking configurations (target lists) the trojan was using.</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Trojan-Banker.Win32.Bolik",
    "Carberp.Variant",
    "Win32/Bolik"
  ],
  "enrichment_level": "insufficient_information",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1185",
    "T1056.001",
    "T1055",
    "T1090"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-01T17:29:35Z",
  "type": "Banking Trojan",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}