{
  "family": "bersek",
  "sample_count": 0,
  "category": "backdoor",
  "description": "Bersek is an intricate malware strain primarily characterized by its capabilities as a backdoor and information stealer. It infiltrates systems typically via social engineering campaigns, malicious email attachments, or drive-by downloads. Once inside, Bersek immediately establishes a hidden presence, often manipulating system services to ensure it runs continuously. The malware is designed to harvest sensitive data, including login credentials, financial information, and personal documents, which it then exfiltrates to attacker-controlled servers. Furthermore, Bersek has the capacity to download and execute secondary payloads, effectively turning the compromised machine into a node for further malicious activities, such as participating in botnets or distributing spam. Its modular nature and use of strong encryption for command and control communications make it a persistent and dangerous threat to enterprise environments.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Bersek Backdoor"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Bersek?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Bersek is a sophisticated backdoor trojan designed for information theft and secondary payload delivery."
      }
    },
    {
      "@type": "Question",
      "name": "How does Bersek usually spread?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It spreads primarily through social engineering tactics, such as phishing emails and malicious downloads."
      }
    },
    {
      "@type": "Question",
      "name": "What kind of data does Bersek target?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It targets sensitive information like credentials, banking details, and personal files."
      }
    },
    {
      "@type": "Question",
      "name": "Can Bersek download other malware?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Yes, its modular design allows it to fetch and execute additional malicious payloads from its C2 server."
      }
    },
    {
      "@type": "Question",
      "name": "How does Bersek maintain persistence?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It often manipulates core Windows services to ensure it remains active across reboots."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1056",
    "T1059",
    "T1543",
    "T1105",
    "T1043"
  ],
  "mitre_attack_detail": [
    {
      "id": "T1056",
      "name": "Input Capture",
      "tactic": "Credential Access"
    },
    {
      "id": "T1059",
      "name": "Command and Scripting Interpreter",
      "tactic": "Execution"
    },
    {
      "id": "T1543",
      "name": "Create or Modify System Process (Establishing persistence)",
      "tactic": "Persistence"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1043",
      "name": "Technique",
      "tactic": "Execution"
    }
  ],
  "containment_steps": [
    "Isolate affected endpoints from the network immediately to sever unauthorized command and control communication.",
    "Identify and terminate active Bersek binaries and associated parent-child process chains.",
    "Audit persistence vectors including Registry Run keys, Scheduled Tasks, and services for unauthorized entries.",
    "Collect forensic disk and memory triage artifacts before conducting system re-imaging."
  ],
  "what_to_avoid": [
    "Do not attempt manual string or file deletion while network connections remain active; this can trigger secondary dropper routines.",
    "Avoid restoring from backups without verifying that the backup snapshot predates initial Bersek installation."
  ],
  "cisa_advisory": null,
  "last_updated": "2026-08-01",
  "sources": [
    {
      "name": "Kaspersky Cyberthreat Glossary - Backdoor.Win32.Bersek",
      "url": "https://threats.kaspersky.com"
    },
    {
      "name": "NIST National Vulnerability Database - CVE-2004-0120",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2004-0120"
    }
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "attack_stage": [
    "initial_access",
    "execution"
  ],
  "is_emerging": false,
  "verification_status": "analyst_verified",
  "severity_rating": "medium",
  "first_seen": 2003,
  "motivation": "Financial Theft",
  "lineage": {
    "derived_from": [
      "win32_bersek_backdoor_engine"
    ],
    "variants": [
      "bersek.a",
      "bersek.gen",
      "win32.bersek"
    ]
  },
  "d3fend": [
    "D3-PSA",
    "D3-FPA",
    "D3-NTA",
    "D3-EFA",
    "D3-MFA"
  ],
  "cve": [
    "CVE-2003-0352",
    "CVE-2004-0120"
  ],
  "iocs": {
    "file_hashes": [
      "29e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0",
      "3af1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1"
    ],
    "delivery": [
      "Compromised freeware distribution mirrors and malicious email attachments",
      "Automated exploitation of unpatched Windows RPC interfaces (CVE-2003-0352)"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\BersekService",
      "System registry Shell spawning hook under Winlogon"
    ]
  },
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}