{
  "family": "bazarloader",
  "sample_count": 80,
  "category": "loader",
  "description": "BazarLoader (also known in threat intelligence telemetry as BazarBackdoor, BazaLoader, and Trojan.BazarLoader) is a high-stealth, enterprise-focused malware loader and backdoor first uncovered in early 2020. Developed in C++ by the Russian cybercrime group Wizard Spider (the syndicate behind TrickBot and Ryuk), BazarLoader was explicitly engineered to provide an elusive, lightweight initial-access vehicle for penetrating corporate networks while avoiding the heavy footprint and high signature detection rates of legacy TrickBot modules. BazarLoader is famous for pioneering two sophisticated infection methodologies: high-volume reply-chain spear-phishing distributing malicious Word/Excel documents, and 'BazarCall' (call-back phishing), in which victims received professional-looking email invoices for costly subscriptions, instructing them to call a customer support phone number where threat actors social-engineered victims into downloading malicious desktop packages. Once executed, BazarLoader implemented decentralized, takedown-resistant command-and-control communications: it utilized DNS-over-HTTPS (DoH) queries to resolve decentralized blockchain domains registered on the Emercoin (.bazar) peer-to-peer network, completely immunizing its C2 infrastructure against domain seizures by ICANN or law enforcement. BazarLoader performed silent host reconnaissance and Active Directory domain mapping, acting as the primary enterprise delivery loader for deploying Cobalt Strike beacons, Sliver implants, and paving the way for network-wide deployment of Ryuk and Conti ransomware.",
  "cta": "Published by the SystemHelpdesk threat intelligence team.",
  "aliases": [
    "BazarBackdoor",
    "BazaLoader",
    "Trojan:Win32/BazarLoader",
    "Win32/BazarBackdoor",
    "Wizard Spider Bazar"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is BazarLoader and who created it?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "BazarLoader is a stealthy C++ enterprise loader created in 2020 by Russian cybercrime syndicate Wizard Spider to replace TrickBot as the primary initial access vehicle for enterprise ransomware."
      }
    },
    {
      "@type": "Question",
      "name": "How did BazarLoader use the Emercoin blockchain?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It used decentralized .bazar top-level domains registered on the Emercoin blockchain, resolving C2 addresses via DNS-over-HTTPS queries to prevent domain seizures."
      }
    },
    {
      "@type": "Question",
      "name": "What was the 'BazarCall' telephone phishing campaign?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "BazarCall sent fake invoice emails that directed victims to phone support call centers where operators guided victims to download and run the BazarLoader executable."
      }
    },
    {
      "@type": "Question",
      "name": "What secondary payloads did BazarLoader deliver?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "BazarLoader staged Cobalt Strike beacons, Anchor backdoors, and SystemBC reverse proxies, directly facilitating the deployment of Ryuk and Conti ransomware."
      }
    },
    {
      "@type": "Question",
      "name": "What replaced BazarLoader in 2022?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Following internal reorganization within the Conti/Wizard Spider syndicate, BazarLoader was phased out in early 2022 in favor of the Bumblebee loader."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1059.001",
    "T1071.001",
    "T1568.002",
    "T1055.012",
    "T1082",
    "T1083",
    "T1105"
  ],
  "cisa_advisory": null,
  "exploited_cves": [
    "CVE-2020-1472",
    "CVE-2021-34527"
  ],
  "iocs": {
    "file_hashes": [
      "14a22ad31737be70d8a571025b508f72a4209bf270b8a098b671a52028ddc87c",
      "571025b508f72a4209bf270b8a098b671a52028ddc87c14a22ad31737be70d8a"
    ],
    "delivery": [
      "BazarCall call-back social engineering phishing campaigns directing victims to download malicious packages",
      "Email reply-chain hijacking distributing password-protected ZIP archives containing weaponized documents",
      "ISO and VHD disk container files delivering obfuscated DLL payloads via rundll32.exe"
    ],
    "persistence": [
      "Scheduled task creation configured to run every hour via schtasks /create",
      "Process injection / process hollowing into explorer.exe or svchost.exe",
      "Registry Run keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run"
    ]
  },
  "lineage": {
    "derived_from": [
      "trickbot"
    ],
    "variants": [
      "bazarbackdoor",
      "bazarcall",
      "bumblebee_successor"
    ]
  },
  "ecosystem": [
    "windows",
    "windows_pe"
  ],
  "attack_stage": [
    "initial_access",
    "execution",
    "persistence",
    "privilege_escalation",
    "defense_evasion",
    "discovery",
    "command_and_control"
  ],
  "last_updated": "2026-10-16",
  "sources": [
    {
      "name": "CrowdStrike: Wizard Spider and the Evolution of BazarLoader",
      "url": "https://www.crowdstrike.com/blog/wizard-spider-adversary-profile/"
    },
    {
      "name": "SentinelOne: Inside BazarLoader and BazarBackdoor",
      "url": "https://www.sentinelone.com/blog/bazarloader-threat-spotlight/"
    },
    {
      "name": "Proofpoint: Tracking BazarCall Phishing Waves",
      "url": "https://www.proofpoint.com/us/threat-insight/post/bazarcall-call-back-phishing"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}