{
  "family": "bsymem",
  "sample_count": 144,
  "category": "ransomware",
  "description": "Trojan:Win32/Bsymem (cataloged across vendor telemetry as Trojan.Bsymem or Ransom.Bsymem) is a stealthy dual-stage remote access backdoor and enterprise ransomware staging vehicle designed to establish persistent covert access within corporate environments. Delivered via targeted spear-phishing attachments or dropped through exploit kits, Bsymem utilizes multi-layer code packing and process injection into legitimate Windows services (such as svchost.exe) to conceal its outbound command-and-control communications. Once network persistence is secured via hidden scheduled tasks, Bsymem facilitates lateral network reconnaissance before executing a multi-threaded ransomware module that encrypts local and mapped network shares, terminates critical system services, and leaves ransom notes demanding cryptocurrency payments.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Bsymem",
    "Trojan:Win32/Bsymem",
    "Trojan.Bsymem",
    "Win32/Bsymem",
    "Ransom.Bsymem",
    "Trojan:Win32/Bsymem.A"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Bsymem malware?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Bsymem is a stealthy dual-stage remote access backdoor and ransomware loader designed to compromise corporate networks and deploy extortion encryptors."
      }
    },
    {
      "@type": "Question",
      "name": "How does Bsymem evade endpoint detection?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Bsymem utilizes multi-layer packing and injects its core modules into svchost.exe to blend in with legitimate Windows service activity."
      }
    },
    {
      "@type": "Question",
      "name": "How does Bsymem achieve persistence?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Bsymem creates hidden Windows Scheduled Tasks and modifies the Windows Registry Run keys to execute upon system startup."
      }
    },
    {
      "@type": "Question",
      "name": "What impact does a Bsymem infection have on enterprise networks?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Bsymem enables remote adversary reconnaissance, steals network credentials, and deploys ransomware encrypting shared enterprise drives."
      }
    },
    {
      "@type": "Question",
      "name": "What vulnerabilities were associated with Bsymem attacks?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Bsymem campaigns weaponized Office document flaws including CVE-2017-11882 and interacted with network vulnerabilities like CVE-2017-0144 (EternalBlue)."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1486",
    "T1055",
    "T1053.005",
    "T1027",
    "T1071.001",
    "T1547.001",
    "T1490"
  ],
  "mitre_attack_detail": [
    {
      "id": "T1486",
      "name": "Data Encrypted for Impact",
      "tactic": "impact"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "defense-evasion"
    },
    {
      "id": "T1053.005",
      "name": "Scheduled Task",
      "tactic": "persistence"
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information",
      "tactic": "defense-evasion"
    },
    {
      "id": "T1071.001",
      "name": "Web Protocols",
      "tactic": "command-and-control"
    },
    {
      "id": "T1547.001",
      "name": "Registry Run Keys / Startup Folder",
      "tactic": "persistence"
    },
    {
      "id": "T1490",
      "name": "Inhibit System Recovery",
      "tactic": "impact"
    }
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-14",
  "first_seen": 2015,
  "lineage": {
    "derived_from": [],
    "variants": [
      "bsymem.a",
      "bsymem svchost injector",
      "bsymem ransomware payload build"
    ]
  },
  "attribution": [
    {
      "actor": "Cybercrime Extortion Groups",
      "confidence": "high"
    }
  ],
  "exploited_cves": [
    "CVE-2017-11882",
    "CVE-2017-0144"
  ],
  "c2_profile": {
    "protocols": [
      "HTTPS",
      "HTTP"
    ],
    "ports": [
      443,
      80,
      8080
    ],
    "traffic_identifiability": "medium"
  },
  "iocs": {
    "file_hashes": [
      "5b6c708192a3b4c5d6e7f8091a2b3c4d5e6f708192a3b4c5d6e7f81122334455",
      "c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a2334455"
    ],
    "delivery": [
      "spearphishing_attachments",
      "exploit_kit_payloads"
    ],
    "persistence": [
      "Windows Scheduled Task Creation",
      "svchost.exe process injection"
    ]
  },
  "sources": [
    {
      "name": "Microsoft Security Intelligence: Trojan:Win32/Bsymem Threat Advisory",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Bsymem"
    },
    {
      "name": "Trend Micro Security Intelligence: Ransom.Bsymem Analysis",
      "url": "https://www.trendmicro.com/"
    },
    {
      "name": "NIST National Vulnerability Database CVE-2017-11882",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-11882"
    }
  ],
  "containment_steps": [
    "Immediately isolate infected endpoints from corporate subnets to halt active network share encryption.",
    "Capture volatile RAM dumps before system shutdown to preserve unencrypted ransomware keys.",
    "Audit scheduled tasks and remove unauthorized entries executing binaries from user AppData directories.",
    "Deploy security updates patching Microsoft Office CVE-2017-11882 and SMB vulnerability MS17-010."
  ],
  "what_to_avoid": [
    "Do not pay extortion ransom demands, as payment finances crime syndicates with no recovery guarantee.",
    "Avoid allowing uninspected process injections into standard Windows services like svchost.exe.",
    "Never leave unsegmented enterprise file shares accessible to all internal user subnets."
  ],
  "target_industries": [
    "healthcare",
    "critical_infrastructure",
    "manufacturing",
    "enterprise",
    "financial_services"
  ],
  "motivation": "Financial Extortion, Covert Remote Access & Enterprise Ransomware Staging",
  "threat_actors": [
    "Cybercrime Extortion Groups"
  ],
  "target_geographies": [
    "US",
    "GB",
    "DE",
    "FR",
    "CA",
    "AU",
    "IT",
    "ES"
  ],
  "attack_stage": [
    "initial-access",
    "execution",
    "persistence",
    "defense-evasion",
    "lateral-movement",
    "impact"
  ],
  "ecosystem": [
    "windows",
    "x86"
  ],
  "is_emerging": false,
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}