{
  "family": "bozok",
  "sample_count": 0,
  "category": "trojan",
  "description": "Bozok is a highly capable Remote Access Trojan (RAT) that first appeared on cybercriminal forums around 2015. Developed in Delphi, Bozok is designed with stealth and flexibility in mind, offering a small footprint and robust anti-analysis features. The malware provides operators with full control over infected machines, including file system access, remote desktop capabilities, registry modification, and a built-in keylogger. It is known to utilize advanced process injection techniques, often hollowing out legitimate processes to hide its malicious code in memory. Furthermore, Bozok employs custom obfuscation and encrypted communication channels to thwart network detection and reverse engineering efforts. It is frequently distributed via weaponized macros in Microsoft Office documents sent in targeted spear-phishing campaigns, making it a persistent threat to corporate networks.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Bozok RAT"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is the Bozok malware?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Bozok is a stealthy and flexible Remote Access Trojan written in Delphi, prevalent since around 2015."
      }
    },
    {
      "@type": "Question",
      "name": "How is Bozok typically distributed?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is often spread through spear-phishing emails containing malicious Microsoft Office macros."
      }
    },
    {
      "@type": "Question",
      "name": "What techniques does Bozok use to remain hidden?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It uses advanced process injection and process hollowing to execute malicious code within legitimate applications."
      }
    },
    {
      "@type": "Question",
      "name": "What features does Bozok offer attackers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It provides remote desktop control, file management, and keylogging capabilities."
      }
    },
    {
      "@type": "Question",
      "name": "Why is Bozok difficult to analyze?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It employs custom obfuscation techniques and encrypts its command and control communications."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1055",
    "T1056",
    "T1059",
    "T1140",
    "T1566"
  ],
  "mitre_attack_detail": [
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1056",
      "name": "Input Capture",
      "tactic": "Credential Access"
    },
    {
      "id": "T1059",
      "name": "Command and Scripting Interpreter",
      "tactic": "Execution"
    },
    {
      "id": "T1140",
      "name": "Deobfuscate/Decode Files or Information",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1566",
      "name": "Phishing",
      "tactic": "Initial Access"
    }
  ],
  "containment_steps": [
    "Isolate affected endpoints from the network immediately to sever unauthorized command and control communication.",
    "Identify and terminate active Bozok binaries and associated parent-child process chains.",
    "Audit persistence vectors including Registry Run keys, Scheduled Tasks, and services for unauthorized entries.",
    "Collect forensic disk and memory triage artifacts before conducting system re-imaging."
  ],
  "what_to_avoid": [
    "Do not attempt manual string or file deletion while network connections remain active; this can trigger secondary dropper routines.",
    "Avoid restoring from backups without verifying that the backup snapshot predates initial Bozok installation."
  ],
  "cisa_advisory": null,
  "last_updated": "2026-08-01",
  "sources": [
    {
      "name": "Trend Micro Threat Encyclopedia - Trojan.Win32.Bozok",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.bozok"
    },
    {
      "name": "NIST National Vulnerability Database - CVE-2012-0158 Overview",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-0158"
    }
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "attack_stage": [
    "initial_access",
    "execution"
  ],
  "is_emerging": false,
  "verification_status": "analyst_verified",
  "severity_rating": "medium",
  "first_seen": 2012,
  "motivation": "Financial Theft",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "target_industries": [
    "Financial Services",
    "Retail",
    "Global / Opportunistic"
  ],
  "lineage": {
    "derived_from": [
      "delphi_rat_framework"
    ],
    "variants": [
      "bozok_v1.4",
      "bozok_builder"
    ]
  },
  "d3fend": [
    "D3-PSA",
    "D3-FPA",
    "D3-NTA",
    "D3-EFA",
    "D3-MFA"
  ],
  "cve": [
    "CVE-2012-0158",
    "CVE-2014-1761"
  ],
  "iocs": {
    "file_hashes": [
      "a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4",
      "b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5"
    ],
    "delivery": [
      "Phishing emails containing malicious RTF and DOC attachments exploiting CVE-2012-0158",
      "Deceptive cracks, game mods, and underground forum downloads"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\BozokClient",
      "Startup shortcut creation in %AppData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup"
    ]
  },
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}