{
  "family": "bayrob",
  "sample_count": 74,
  "category": "trojan",
  "description": "Bayrob (cataloged across cybersecurity research and international law enforcement filings as Trojan.Bayrob, Win32/Bayrob, and W32.Bayrob) was a notorious cybercriminal botnet and fraud trojan operated for nearly a decade by a Romanian cybercrime syndicate led by Bogdan Nicolescu, Danet Tiberiu, and Radu Miclaus. Originating around 2007, Bayrob initially powered large-scale online vehicle and auction fraud schemes on platforms like eBay, spoofing legitimate escrow services to divert buyer funds. Over time, the gang evolved Bayrob into an expansive botnet spanning over 300,000 compromised computers, propagating via massive spam campaigns sending over 11 million emails with weaponized attachments. The malware modified browser proxy settings to perform man-in-the-middle credential harvesting, injected cryptocurrency miners, and exfiltrated sensitive financial data. Following a decade-long collaborative investigation between Symantec, the FBI, and Romanian authorities, the core operators were arrested in 2016, extradited to the United States, and convicted of wire fraud, identity theft, and money laundering in federal court.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan.Bayrob",
    "Win32/Bayrob",
    "W32.Bayrob",
    "Trojan:Win32/Bayrob"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What was the Bayrob malware operation?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Bayrob was a decade-long cybercrime botnet and fraud operation responsible for stealing millions via auction scams and cryptomining."
      }
    },
    {
      "@type": "Question",
      "name": "Who operated the Bayrob botnet?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It was operated by Romanian cybercriminals Bogdan Nicolescu, Danet Tiberiu, and Radu Miclaus, who were convicted in U.S. federal court."
      }
    },
    {
      "@type": "Question",
      "name": "How did Bayrob infect over 300,000 computers worldwide?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "The gang sent over 11 million malicious spam emails disguised as invoices and auction vehicle slideshows."
      }
    },
    {
      "@type": "Question",
      "name": "What functions were performed by the Bayrob trojan on victim machines?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It hijacked web proxies for eBay auction spoofing, mined cryptocurrency, stole credentials, and relayed spam."
      }
    },
    {
      "@type": "Question",
      "name": "How was the Bayrob cybercrime ring dismantled?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Through a coordinated multi-year investigation between Symantec, the FBI, and Romanian law enforcement resulting in 2016 arrests."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1566.001",
    "T1189",
    "T1112",
    "T1555.003",
    "T1496",
    "T1082",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1185",
      "name": "Browser Session Hijacking",
      "tactic": "Collection"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    },
    {
      "id": "T1090.001",
      "name": "Proxy: Internal Proxy",
      "tactic": "Command and Control"
    },
    {
      "id": "T1543.003",
      "name": "Create or Modify System Process: Windows Service",
      "tactic": "Persistence"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Immediately isolate the endpoint from the network to sever the local proxy interception and halt the exfiltration of credentials.",
    "Audit the system's local proxy settings (e.g., `Internet Options -> Connections -> LAN settings`) and remove any malicious entries pointing to `127.0.0.1`.",
    "Capture a full forensic memory image to extract the active Bayrob payload and the web inject configurations it currently holds in RAM.",
    "Assume all credentials and financial data entered on the machine have been compromised; initiate mandatory password resets."
  ],
  "what_to_avoid": [
    "Do not trust the integrity of any web session initiated from the infected machine; Bayrob actively alters the HTML presented to the user.",
    "Avoid relying solely on basic AV scans; the deep system hooks often require manual registry and service remediation."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Financial Fraud & Cybercrime Monetization",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2007,
  "threat_actor": "Bayrob Cybercrime Group (Bogdan Nicolescu, Danet Tiberiu, Radu Miclaus)",
  "delivery_mechanism": [
    "Mass Malicious Spam Campaigns (11M+ Emails)",
    "Fraudulent Vehicle Auction Invoices",
    "Malicious Executable Slideshows"
  ],
  "target_platforms": [
    "Windows 10",
    "Windows 8.1",
    "Windows 7",
    "Windows Vista",
    "Windows XP"
  ],
  "capabilities": [
    "Browser Proxy Redirection (Man-in-the-Middle)",
    "eBay & Online Auction Spoofing",
    "Cryptocurrency Mining",
    "Credit Card & Credential Harvesting",
    "P2P and C2 Botnet Communication"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Dynamic Link Library (DLL)"
    ],
    "network_signatures": [
      "Local proxy redirection on localhost ports routing browser HTTP traffic",
      "C2 communication to domain generation algorithm (DGA) endpoints"
    ],
    "evasion_techniques": [
      "Anti-debugging loops and taunts embedded in binary code directed at researchers",
      "Encrypted configuration blocks unpacked dynamically in memory"
    ],
    "persistence_mechanisms": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\BayrobClient",
      "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\WindowsUpdateService"
    ]
  },
  "impact": {
    "confidentiality": "High",
    "integrity": "High",
    "availability": "Medium",
    "scope": "Tens of millions of dollars in financial fraud, identity theft, credit card compromise, cryptomining strain"
  },
  "lineage": {
    "derived_from": [
      "Custom Romanian Cybercrime Trojan Framework"
    ],
    "variants": [
      "Bayrob.A",
      "Bayrob.B",
      "Bayrob.C"
    ]
  },
  "iocs": {
    "file_hashes": [
      "c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8",
      "d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9"
    ],
    "delivery": [
      "invoice_ebay.exe",
      "vehicle_photos.scr"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Bayrob",
      "%SystemRoot%\\System32\\bayrob_host.exe"
    ]
  },
  "sources": [
    {
      "name": "Broadcom Symantec Security Response - The Bayrob Group: A 10-Year Cybercrime Odyssey",
      "url": "https://www.broadcom.com/support/security-center"
    },
    {
      "name": "Federal Bureau of Investigation (FBI.gov) - Romanian Hackers Sentenced in Major Cybercrime Scheme",
      "url": "https://www.fbi.gov"
    }
  ]
}