{
  "family": "bandook",
  "sample_count": 0,
  "category": "rat",
  "description": "Bandook (derived from the Arabic and Hindi word for 'gun' or 'rifle') is an enduring, modular Remote Access Trojan first created in 2005 by Lebanese software author 'PrinceAli' (Prince Ali). Originally distributed across underground cybercrime forums as a commercial administration tool, Bandook underwent major modular modernizations that transformed it from commodity malware into a customized espionage weapon deployed by state-aligned actors and mercenary hacker-for-hire groups.\n\nIn 2018, extensive joint research by the Electronic Frontier Foundation (EFF) and Lookout revealed Bandook's pivotal role in 'Operation Dark Caracal'—a massive global surveillance campaign attributed to the Lebanese General Directorate of General Security (GDGS) targeting military officials, government personnel, activists, and journalists across 21 countries. Bandook resurfaced subsequently in targeted financial and legal sector attacks, utilizing digitally signed binaries with stolen certificates, image steganography (JPEG images hiding encrypted payloads), and process hollowing into explorer.exe to evade modern endpoint defenses.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Bandook",
    "Bandook RAT",
    "Trojan.Bandook",
    "Backdoor.Bandook",
    "Win32/Bandook"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Bandook RAT?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Bandook is a modular Remote Access Trojan created in 2005 by Lebanese developer PrinceAli that was weaponized in state-sponsored espionage operations."
      }
    },
    {
      "@type": "Question",
      "name": "What was Operation Dark Caracal?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Operation Dark Caracal was a global espionage campaign uncovered in 2018 by the EFF and Lookout that used Bandook to spy on military and political targets across 21 nations."
      }
    },
    {
      "@type": "Question",
      "name": "How does modern Bandook evade antivirus detection?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Modern variants use image steganography to conceal encrypted code in image files, sign binaries with stolen digital certificates, and inject code into trusted processes via process hollowing."
      }
    },
    {
      "@type": "Question",
      "name": "What vulnerabilities are used to drop Bandook?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Campaigns frequently deploy Bandook via malicious Office documents exploiting Equation Editor (CVE-2017-11882) and Office RCE (CVE-2017-0199)."
      }
    },
    {
      "@type": "Question",
      "name": "How do organizations defend against Bandook?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Defenders should enforce certificate validation, monitor for anomalous outbound traffic to unclassified domains, and deploy memory-scanning EDR solutions that detect process hollowing."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1055.012",
    "T1056.001",
    "T1113",
    "T1071.001",
    "T1547.001",
    "T1027"
  ],
  "mitre_attack_detail": [
    {
      "id": "T1056",
      "name": "Input Capture",
      "tactic": "Credential Access"
    },
    {
      "id": "T1113",
      "name": "Screen Capture",
      "tactic": "Collection"
    },
    {
      "id": "T1125",
      "name": "Video Capture",
      "tactic": "Collection"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1547",
      "name": "Boot or Logon Autostart Execution (Winlogon/BHO)",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Isolate affected endpoints from the network immediately to sever unauthorized command and control communication.",
    "Identify and terminate active Bandook binaries and associated parent-child process chains.",
    "Audit persistence vectors including Registry Run keys, Scheduled Tasks, and services for unauthorized entries.",
    "Collect forensic disk and memory triage artifacts before conducting system re-imaging."
  ],
  "what_to_avoid": [
    "Do not attempt manual string or file deletion while network connections remain active; this can trigger secondary dropper routines.",
    "Avoid restoring from backups without verifying that the backup snapshot predates initial Bandook installation."
  ],
  "cisa_advisory": null,
  "last_updated": "2026-08-01",
  "sources": [
    {
      "name": "Electronic Frontier Foundation - Dark Caracal: Cyber-espionage at a Global Scale",
      "url": "https://www.eff.org/pages/dark-caracal"
    },
    {
      "name": "MITRE ATT&CK - Bandook (S0335)",
      "url": "https://attack.mitre.org/software/S0335/"
    },
    {
      "name": "CISA Advisory - Mercenary Malware Weaponization",
      "url": "https://www.cisa.gov/news-events/cybersecurity-advisories"
    }
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "attack_stage": [
    "initial_access",
    "execution"
  ],
  "is_emerging": false,
  "verification_status": "analyst_verified",
  "severity_rating": "medium",
  "first_seen": 2005,
  "lineage": {
    "derived_from": [],
    "variants": [
      "bandook v1.0 (2005)",
      "bandook v2.0",
      "operation dark caracal build (2018)",
      "signed mercenary variant (2020)"
    ]
  },
  "attribution": [
    {
      "actor": "PrinceAli (Original Author) / Lebanese GDGS (Operation Dark Caracal - EFF/Lookout)",
      "confidence": "high",
      "basis": "Authored in 2005 by PrinceAli. Disclosed in January 2018 by EFF and Lookout as the primary Windows espionage tool in Operation Dark Caracal, traced to the Lebanese General Directorate of General Security.",
      "source": "https://attack.mitre.org/software/S0335/"
    }
  ],
  "exploited_cves": [
    "CVE-2017-0199",
    "CVE-2017-11882"
  ],
  "c2_profile": {
    "protocols": [
      "HTTP",
      "HTTPS",
      "Encrypted TCP",
      "Image Steganography C2"
    ],
    "ports": [
      80,
      443,
      8080
    ],
    "infrastructure": "Dynamic DNS and compromised web servers hosting JPEG and PNG image files containing Base64-encrypted payloads and secondary C2 instructions extracted via custom steganography routines."
  },
  "iocs": {
    "file_hashes": [
      "4a242f36f6d895f462ebc8375e87a26f8303f26cfb16954316d2ca0190abf0c1",
      "9e49c7161bcf76ee8a20da62fecbf9bb748a31a98059bf4ce126ecba95f002f1"
    ],
    "delivery": [
      "Targeted spear-phishing emails containing weaponized Word documents exploiting CVE-2017-0199 and CVE-2017-11882",
      "Watering hole websites and fraudulent secure messaging applications"
    ],
    "persistence": [
      "Process hollowing and thread hijacking into explorer.exe or system binaries",
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run registry modification"
    ]
  },
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}