{
  "family": "glupteba",
  "sample_count": 32,
  "category": "trojan",
  "description": "Trojan:Win32/Glupteba is a highly advanced, resilient botnet and Trojan downloader primarily known for its incredibly sophisticated Command and Control (C2) architecture. Specifically, Glupteba pioneered the use of the Bitcoin blockchain as a distributed, un-takedownable C2 infrastructure to evade law enforcement and security vendors.<br><br><b>Understanding Glupteba</b><br>To the victim, Glupteba is invisible, acting as a delivery vehicle for other malware (often cryptominers or credential stealers). For threat intelligence analysts, Glupteba represents a masterclass in C2 resilience. When the FBI or security vendors attempt to shut down a botnet, they target the centralized C2 servers. Glupteba circumvents this entirely. When a Glupteba infection loses contact with its hardcoded C2 servers, it relies on an ingenious fallback mechanism: it queries the public Bitcoin blockchain.<br><br><b>Execution and Blockchain C2 Evasion</b><br>Upon execution, Glupteba establishes deep persistence, often deploying a rootkit (`T1014`) to hide its files and registry keys. It then attempts to contact its C2. If the C2 is dead, the malware uses a public Bitcoin API (like `blockchain.info`) to query the transaction history of specific Bitcoin wallet addresses hardcoded into the malware (`T1102.001`). The threat actors use the `OP_RETURN` field in Bitcoin transactions to embed small snippets of encrypted data. Glupteba reads this transaction data, decrypts it, and retrieves the *new* C2 domain or IP address. Because the Bitcoin blockchain is decentralized and immutable, security vendors cannot delete the C2 instructions; the infrastructure is virtually bulletproof.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is extreme persistence and the constant downloading of secondary payloads. EDR platforms will flag Glupteba's rootkit installation attempts and its aggressive process injection. Network logs will reveal anomalous, automated queries to public Bitcoin block explorers (`T1102`). Incident responders must look for the presence of the `csrss.exe` process spawning from unexpected directories, as Glupteba frequently masquerades as the Client Server Runtime Process.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1055",
    "T1562.001",
    "T1014",
    "T1102.001",
    "T1036.005"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1102.001",
      "name": "Web Service: Dead Drop Resolver",
      "tactic": "Command and Control"
    },
    {
      "id": "T1014",
      "name": "Rootkit",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1036.005",
      "name": "Masquerading: Match Legitimate Name or Location",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Instantly isolate the endpoint from the network; Glupteba's blockchain resolution means it can re-establish C2 instantly if left online.",
    "Due to the deployment of rootkits, do not trust the live operating system. Run offline forensic scans or utilize specialized rootkit removal tools.",
    "Monitor network edge firewalls for automated API calls to Bitcoin block explorers (e.g., blockchain.info, blockexplorer.com) originating from endpoints.",
    "Given the deep system compromise and rootkit presence, a complete rebuild of the operating system is the only guaranteed remediation."
  ],
  "what_to_avoid": [
    "Do not assume the threat is neutralized because you blocked the current C2 IP; Glupteba will simply query the blockchain and find the next one.",
    "Avoid relying solely on standard AV scans; the rootkit components hide the malicious binaries from the file system."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}