{
  "family": "bunitu",
  "sample_count": 49,
  "category": "trojan",
  "description": "Trojan:Win32/Bunitu is a massive, highly resilient proxy botnet agent. Its primary function is to silently infect machines and turn them into hidden proxy servers, allowing cybercriminals to route malicious traffic—such as spam, vulnerability scanning, or C2 communications—through the infected host, effectively anonymizing their attacks.<br><br><b>Understanding Bunitu</b><br>To the end-user, a Bunitu infection is completely invisible; there are no pop-ups or ransom notes. However, their machine is now a willing participant in global cybercrime. For threat intelligence analysts, Bunitu is a massive infrastructure provider. Cybercriminal groups 'rent' access to the Bunitu botnet to hide their true IP addresses. If an enterprise network is infected with Bunitu, the company's public IP address will be used to launch attacks against others, leading to IP blacklisting and severe reputational damage.<br><br><b>Execution and Evasion Strategies</b><br>Bunitu is typically distributed as a secondary payload, dropped by exploit kits (like Neutrino) or other trojan downloaders. Upon execution, it establishes persistence via the Registry Run keys. It communicates with its Command and Control (C2) server to register the new proxy node. Bunitu then opens specific ports (often random high-numbered ports) and begins accepting incoming connections from the attacker network (`T1090`). It leverages advanced hooking techniques within the Windows networking stack (Winsock) to ensure the proxy traffic bypasses local firewalls and is difficult to monitor with standard packet sniffers.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the hijacking of network bandwidth and the severe risk of the corporate IP being blacklisted by global threat intelligence feeds. Incident responders will observe a massive, sustained volume of anomalous inbound and outbound traffic on random, high-numbered ports. EDR platforms will flag Bunitu's API hooking attempts (`T1055`) within network-facing processes. The infected host will essentially act as a relay, with traffic entering from one unfamiliar IP and immediately exiting to another.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1547.001",
    "T1562.001",
    "T1090",
    "T1055",
    "T1105"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1090",
      "name": "Proxy",
      "tactic": "Command and Control"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Immediately isolate the endpoint from the network to halt the relaying of malicious proxy traffic and prevent IP blacklisting.",
    "Enforce strict egress filtering at the corporate firewall, dropping all outbound connections on non-standard ports until the infection is cleared.",
    "Capture a forensic memory image to extract the active Bunitu configuration and identify the specific C2 servers coordinating the proxy network.",
    "Assume the endpoint is compromised; a clean OS rebuild is recommended to ensure all Winsock hooks and rootkit components are removed."
  ],
  "what_to_avoid": [
    "Do not ignore the infection as simply 'high bandwidth usage'; your infrastructure is actively participating in cyber attacks.",
    "Avoid relying solely on file deletion; the networking hooks must be cleared from memory."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}