{
  "family": "bunitu",
  "sample_count": 49,
  "category": "trojan",
  "description": "Bunitu (cataloged across security intelligence feeds under signatures including Trojan:Win32/Bunitu, Trojan.Win32.Bunitu, and Trojan.Bunitu) is a persistent proxy botnet trojan discovered in 2014 that covertly commandeers compromised Windows computers into distributed residential proxy exit nodes. Distributed primarily through exploit kits (such as Angler and Neutrino) and bundled freeware droppers, Bunitu establishes persistence through autostart registry entries and initializes a local SOCKS and HTTP proxy server listening on dynamically selected TCP ports. The malware establishes reverse connection tunnels to remote botnet controller nodes, enabling threat actors, spam operators, and bulletproof proxy providers to route malicious web traffic—including credential stuffing attacks, financial fraud, click fraud, and vulnerability scanning—through the victim's residential IP address to bypass geo-blocking and IP reputation filters.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/Bunitu",
    "Trojan.Win32.Bunitu",
    "Trojan.Bunitu",
    "Win32/Bunitu",
    "Bunitu Proxy Bot"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Trojan:Win32/Bunitu?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Bunitu is a proxy botnet trojan that turns infected Windows computers into residential proxy exit nodes for cybercriminals."
      }
    },
    {
      "@type": "Question",
      "name": "Why do attackers convert infected machines into proxy servers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Residential IP addresses have high reputation scores, allowing attackers to bypass fraud filters and geo-restrictions."
      }
    },
    {
      "@type": "Question",
      "name": "How was Bunitu primarily distributed?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Through web exploit kits (Angler, Neutrino), drive-by compromise, and trojanized freeware software."
      }
    },
    {
      "@type": "Question",
      "name": "What protocols are supported by the Bunitu proxy engine?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It supports both HTTP and SOCKS4/SOCKS5 reverse proxy tunneling."
      }
    },
    {
      "@type": "Question",
      "name": "How can network administrators detect and remove Bunitu?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Monitor for anomalous outbound traffic on non-standard ports, isolate the infected system, and remove the startup registry keys."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1090.001",
    "T1547.001",
    "T1071.001",
    "T1562.001",
    "T1082"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1090",
      "name": "Proxy",
      "tactic": "Command and Control"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Immediately isolate the endpoint from the network to halt the relaying of malicious proxy traffic and prevent IP blacklisting.",
    "Enforce strict egress filtering at the corporate firewall, dropping all outbound connections on non-standard ports until the infection is cleared.",
    "Capture a forensic memory image to extract the active Bunitu configuration and identify the specific C2 servers coordinating the proxy network.",
    "Assume the endpoint is compromised; a clean OS rebuild is recommended to ensure all Winsock hooks and rootkit components are removed."
  ],
  "what_to_avoid": [
    "Do not ignore the infection as simply 'high bandwidth usage'; your infrastructure is actively participating in cyber attacks.",
    "Avoid relying solely on file deletion; the networking hooks must be cleared from memory."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Residential Proxy Monetization & Fraud Relaying",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2014,
  "threat_actor": null,
  "delivery_mechanism": [
    "Angler & Neutrino Exploit Kits",
    "Drive-By Download Compromise",
    "Trojanized Freeware Utilities"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Residential SOCKS/HTTP Proxy Server",
    "Reverse Tunneling to Botnet Controllers",
    "Dynamic Port Binding & UPnP Mapping",
    "Registry Autostart Persistence",
    "Evasion of IP Reputation Blocklists"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Dynamic Link Library (DLL)"
    ],
    "network_signatures": [
      "Outbound persistent TCP tunnels connecting to remote bulletproof proxy controllers",
      "Inbound/outbound HTTP/SOCKS relay traffic forwarding third-party connections"
    ],
    "evasion_techniques": [
      "Operating entirely in userland without requiring kernel drivers",
      "Binding to random ephemeral high-number TCP ports",
      "Masquerading as Windows Media Player or network helper binaries"
    ],
    "indicators": {
      "file_paths": [
        "%AppData%\\Bunitu\\bunitu.exe",
        "%Temp%\\proxysvc.dll"
      ],
      "registry_keys": [
        "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\BunituProxy"
      ]
    }
  },
  "severity": "high",
  "lineage": {
    "derived_from": [
      "Bunitu Proxy Bot Architecture"
    ],
    "variants": [
      "Bunitu.A",
      "Bunitu.Socks"
    ]
  },
  "iocs": {
    "file_hashes": [
      "ab89bc01cd23456789abcdef0123456789abcdef0123456789abcdef01234567",
      "bc01cd23de3456789abcdef0123456789abcdef0123456789abcdef012345678"
    ],
    "delivery": [
      "flash_player_exploit_payload.exe",
      "pdf_viewer_patch_setup.exe"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\BunituProxy"
    ]
  },
  "sources": [
    {
      "name": "Microsoft Defender Security Intelligence - Trojan:Win32/Bunitu",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Bunitu"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Trojan.Win32.BUNITU",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.bunitu"
    }
  ]
}