Bisonal

Overview

Backdoor:Win32/Bisonal is a notorious, long-standing Remote Access Trojan (RAT) heavily utilized by various Chinese-speaking Advanced Persistent Threat (APT) groups (including Tonto Team and Tick). Bisonal is primarily deployed in targeted cyber-espionage campaigns against government, military, and critical infrastructure sectors across Asia (specifically South Korea, Japan, and Russia). Its core function is to establish a covert, persistent backdoor (`T1059`) to facilitate the theft of classified data and strategic intelligence.

Understanding Bisonal (APT RAT)
To an end-user, the system operates completely normally. For a threat hunter, discovering a Bisonal infection indicates a highly targeted, severe breach by a sophisticated nation-state adversary. Bisonal is continually updated by its operators; newer variants (sometimes tracked as 'Bisonal.B' or 'Biob') feature improved obfuscation and custom encryption to evade network detection.

Execution and Evasion Strategies
Bisonal is almost exclusively deployed via spear-phishing (`T1566.001`), utilizing highly tailored lures containing malicious attachments (often exploiting legacy CVEs in Microsoft Office, like CVE-2012-0158, or using malicious macros). Upon execution, the malware typically drops a decoy document to distract the user while installing the RAT in the background. It establishes persistence by creating a Windows Service (`T1543.003`) or modifying the `Run` registry keys. Bisonal communicates with its C2 infrastructure using custom, dynamically generated protocols over HTTP or HTTPS, granting the attacker full command execution, file upload/download, and the ability to execute secondary modules (like keyloggers or credential dumpers).

Indicators of Compromise & Impact
The impact is the catastrophic, long-term loss of highly sensitive and classified information. Host-based IoCs include the creation of suspicious Windows Services, anomalous executables running from `%Temp%` or `%AppData%`, and EDR alerts for known exploitation techniques originating from office applications (e.g., `winword.exe` spawning `cmd.exe`). Network IoCs require deep packet inspection to identify the custom beaconing patterns and encryption routines characteristic of Bisonal C2 traffic.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1059: Restrict execution of scripting languages such as PowerShell, VBScript, or Python to authorized administrators. Enforce Script Block Logging.
• T1566.001: Scan email attachments for malicious macros, scripts, or suspicious archive files.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_BISONAL {
    meta:
        description = "Detects Bisonal (trojan)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "bisonal" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Bisonal Activity
id: da82caafcb56470fd52bcf7a48bb1da0
status: experimental
description: Detects generic indicators of the bisonal malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*bisonal*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Immediately isolate the compromised endpoint and assume the entire domain is compromised; engage a specialized Incident Response (IR) firm.
2. Perform a comprehensive enterprise-wide hunt for similar malware, focusing on the specific C2 infrastructure identified on the initial host.
3. Initiate a full credential reset for the entire organization, as the attackers likely deployed tools like Mimikatz after establishing the backdoor.
4. Analyze email gateways and proxy logs to identify the original spear-phishing email and determine if other employees were targeted or compromised.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not attempt to remediate an APT infection by simply deleting the Bisonal executable; the actors almost certainly have secondary backdoors deployed.
2. Avoid communicating about the incident on the compromised corporate network; assume the attackers are monitoring emails.

References & External Analysis

• Search "bisonal" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: trojan)

Explore other malware families in the same category:

• Trickbot
• Qqshou
• Xpaj
• Zboter
• Installflash

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/bisonal.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.