Avenger

Executive Summary

Avenger is a Windows downloader used by the BRONZE BUTLER group since 2019, fetching additional malware via HTTP/HTTPS. Its lightweight nature allows it to serve as a first‑stage component that enables persistence, lateral movement, and further compromise. Detecting its network artifacts early can stop subsequent payloads from being delivered.

Avenger is a lightweight downloader malware identified in threat intelligence that has been employed by the BRONZE BUTLER threat actor since at least 2019, according to Trend Micro’s November 2019 bulletin. As its primary function, Avenger downloads additional malicious payloads from remote servers once it gains initial foothold on a Windows system. The downloader exhibits classic C2 behavior, retrieving binaries over HTTP or HTTPS through hard‑coded URLs and storing them in temporary or program directories before executing. While the specific capabilities of each staged component are not disclosed in publicly available material, downloaders such as Avenger typically facilitate further compromise by delivering backdoors, ransomware agents, or credential harvesters. Because the payload is minimal and only transmits to known command‑and‑control endpoints, detection relies heavily on behavioral indicators rather than on file hash. Analysts observe that Avenger often triggers after exploitation of software vulnerabilities or spear‑phishing campaigns, positioning it as a first‑stage component in multi‑step attacks. The impact of Avenger grows when subsequent staged malware succeeds; the downloader enables persistent access and lateral movement within target networks, potentially leading to data exfiltration, sabotage, or financial theft. Understanding its role is critical for early containment before more destructive payloads arrive.

Key Capabilities

• Downloads executable or script payloads from remote servers
• Establishes outbound connections to command-and-control endpoints via HTTP/HTTPS
• Writes retrieved files to disk in temporary or application directories
• Executes downloaded binaries to continue the attack chain
• Attempts persistence on compromised Windows systems

ATT&CK Techniques

Recommended Actions

• Identify and quarantine any processes exhibiting anomalous outgoing HTTPS traffic to unknown domains
• Deploy network intrusion detection signatures for known Avenger command-and-control IPs and URLs
• Use endpoint protection with behavior-based alerting for file download from unexpected sources
• Block or monitor execution of unknown downloaded executables in temporary directories
• Apply strict egress filtering to prevent outbound connections on unapproved ports

Suggested Tags