Bandook

Overview

Bandook (derived from the Arabic and Hindi word for 'gun' or 'rifle') is an enduring, modular Remote Access Trojan first created in 2005 by Lebanese software author 'PrinceAli' (Prince Ali). Originally distributed across underground cybercrime forums as a commercial administration tool, Bandook underwent major modular modernizations that transformed it from commodity malware into a customized espionage weapon deployed by state-aligned actors and mercenary hacker-for-hire groups. In 2018, extensive joint research by the Electronic Frontier Foundation (EFF) and Lookout revealed Bandook's pivotal role in 'Operation Dark Caracal'—a massive global surveillance campaign attributed to the Lebanese General Directorate of General Security (GDGS) targeting military officials, government personnel, activists, and journalists across 21 countries. Bandook resurfaced subsequently in targeted financial and legal sector attacks, utilizing digitally signed binaries with stolen certificates, image steganography (JPEG images hiding encrypted payloads), and process hollowing into explorer.exe to evade modern endpoint defenses.

Known aliases

Threat reports may refer to this family under multiple names:

• Bandook
• Bandook RAT
• Trojan.Bandook
• Backdoor.Bandook
• Win32/Bandook

Threat Actor Attribution

Attribution is probabilistic, not a science. Each link below states its confidence level and the evidence behind it.

• PrinceAli (Original Author) / Lebanese GDGS (Operation Dark Caracal - EFF/Lookout) High confidence
  Basis: Authored in 2005 by PrinceAli. Disclosed in January 2018 by EFF and Lookout as the primary Windows espionage tool in Operation Dark Caracal, traced to the Lebanese General Directorate of General Security. [source]

Family Pedigree & Lineage

Malware authors regularly fork and iterate upon existing codebases. Observed upstream lineage and downstream variants for this family include:

Known Derivatives & Downstream Variants: Bandook V1.0 (2005) · Bandook V2.0 · Operation Dark Caracal Build (2018) · Signed Mercenary Variant (2020)

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to our technical analysis hubs and the official MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1056: Monitor for unauthorized keylogging, screen capturing, or web browser API hooking. Deploy EDR to detect API hooking.
• T1113: Monitor for frequent or unauthorized screen captures or clipboard reads. Restrict background applications from accessing desktop APIs.
• T1125: Restrict access to local camera or microphone APIs. Utilize endpoint protection that monitors hardware access.

MITRE D3FEND™ Defensive Countermeasures

Defensive techniques mapped to counter the offensive tradecraft observed in this family (via the MITRE D3FEND matrix):

Exploited Vulnerabilities (CVEs)

This malware family is documented weaponizing the following common vulnerabilities and exposures:

• CVE-2017-0199 — In-depth exploitation analysis and catalog intelligence (NIST NVD ↗).
• CVE-2017-11882 — In-depth exploitation analysis and catalog intelligence (NIST NVD ↗).

Command & Control (C2) and Network Profile

How this family talks to its operators. C2 traffic can often identify a family even when its code and configuration are hard to analyse. Ports and patterns are historical and change between campaigns, so use them as hunting leads rather than block-only rules.

Indicators of Compromise

Public indicators drawn from CISA advisories and vendor reporting. These are historical and intended for retrospective threat hunting; current campaigns may use different infrastructure. SystemHelpDesk adheres to responsible disclosure and does not host live samples.

File hashes (SHA-256, sample)

Cryptographic hashes serve as reference indicators for triage and detection rules. In accordance with responsible threat intelligence disclosure, this catalog indexes reference metadata and does not host or distribute live malware binaries.

• 4a242f36f6d895f462ebc8375e87a26f8303f26cfb16954316d2ca0190abf0c1
• 9e49c7161bcf76ee8a20da62fecbf9bb748a31a98059bf4ce126ecba95f002f1

Delivery vectors

• Targeted spear-phishing emails containing weaponized Word documents exploiting CVE-2017-0199 and CVE-2017-11882
• Watering hole websites and fraudulent secure messaging applications

Persistence mechanisms

• Process hollowing and thread hijacking into explorer.exe or system binaries
• HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry modification

Tiered Detection Rules (Cisco CAIRN Model)

Modern threat detection requires multi-layered rule engineering. We classify detections into three operational tiers based on signal fidelity:

rule MALWARE_WIN_BANDOOK_T1_ARTIFACT {
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bandook"
        tier = "T1 - Primitive Artifact"
        confidence = "Low-Medium (Fast Triage)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        $s1 = "bandook" ascii wide nocase
        $s2 = "bandook" ascii wide nocase
        $s3 = "bandook rat" ascii wide nocase
        $s4 = "trojan.bandook" ascii wide nocase
        $s5 = "backdoor.bandook" ascii wide nocase
        $s6 = "win32/bandook" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

title: SystemHelpDesk Detection - Bandook (Rat) Execution & Triage
id: 6de8da98-f261-5028-981b-8c5d7ee54db8
status: production
description: Detects execution, defense evasion, and persistence behaviors associated
  with the Bandook malware family. Detects unauthorized persistence creation via Windows
  Registry Run keys, scheduled tasks, and privilege escalation indicative of RAT installations.
references:
- https://malware-families-catalog.systemhelpdesk.com/families/bandook
- https://malware-families-catalog.systemhelpdesk.com/defensive/backdoor-rat-protection
- https://malware-families-catalog.systemhelpdesk.com/
author: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP
date: '2026-10-14'
modified: '2026-10-14'
tags:
- attack.rat
- author.ricky-jordan
- source.systemhelpdesk-mfc
- attack.t1055_012
- attack.t1056_001
- attack.t1113
- attack.t1071_001
- attack.t1547_001
logsource:
  category: process_creation
  product: windows
detection:
  selection_process:
    Image|endswith:
    - \reg.exe
    - \schtasks.exe
    - \cmd.exe
    - \powershell.exe
    CommandLine|contains:
    - \CurrentVersion\Run
    - /create /tn
    - bypass -enc
    - net user /add
    - net localgroup administrators
  condition: selection_process
falsepositives:
- Legitimate enterprise administrative scripts during approved change windows
- Authorized IT software deployment utilities and backup management agents
level: high

rule MALWARE_WIN_BANDOOK_T3_ATTRIBUTION {
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bandook tradecraft"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        // Core family identifier & heuristic payload signatures
        $attrib_str = "bandook" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker = "http" ascii nocase
    condition:
        uint16(0) == 0x5a4d and ($attrib_str and $net_marker) and filesize < 15MB
}

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Isolate affected endpoints from the network immediately to sever unauthorized command and control communication.
2. Identify and terminate active Bandook binaries and associated parent-child process chains.
3. Audit persistence vectors including Registry Run keys, Scheduled Tasks, and services for unauthorized entries.
4. Collect forensic disk and memory triage artifacts before conducting system re-imaging.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not attempt manual string or file deletion while network connections remain active; this can trigger secondary dropper routines.
2. Avoid restoring from backups without verifying that the backup snapshot predates initial Bandook installation.

References & External Analysis

• Electronic Frontier Foundation - Dark Caracal: Cyber-espionage at a Global Scale
• MITRE ATT&CK - Bandook (S0335)
• CISA Advisory - Mercenary Malware Weaponization
• Search "bandook" on VirusTotal (External Analysis)
• Search "bandook" on Any.Run (Sandbox Sandbox)
• Search "bandook" on MalwareBazaar (Malware Samples)

Frequently Asked Questions

Related Threats (Category: Rat)

Explore other documented threats in the same operational category:

• Gh0St
• Serenity_Rat
• Pcclient
• Xtrat
• Asyncrat
• Bladabindi
• Prorat
• Houndhack

Machine-readable

Get this profile as JSON: https://malware-families-catalog.systemhelpdesk.com/api/bandook.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.