Bandook

Executive Summary

Bandook is a legacy commercial RAT capable of remote desktop control and extensive credential theft, targeting high‑profile sectors worldwide. First seen over a decade ago, it remains actively used by groups such as Dark Caracal in targeted campaigns like "Operation Manul." The malware’s persistence and data exfiltration capabilities pose significant risk to government and critical infrastructure assets.

Bandook is a commercial remote‑access trojan (RAT) that has been available since at least 2007. The code base is written in Delphi alongside a C++ component, allowing the malware to blend both managed and native Windows APIs for persistence and stealth. The Trojan provides attackers with comprehensive control over compromised hosts, including full remote desktop emulation, system command execution, file exfiltration, and credential theft. Operators often use Bandook to conduct large‑scale campaigns against high‑value targets in the government, financial, energy, healthcare, education, IT, and legal sectors across the United States, South America, Europe, and Southeast Asia. Bandook has been linked to multiple APT groups, notably Dark Caracal, and was used in an operation referred to as "Operation Manul". Its deployment frequently involves spear‑phishing or supply‑chain vectors that deliver the bundled Delphi/C++ executable. Although specific configuration details vary by campaign, the malware consistently demonstrates advanced persistence mechanisms, lateral movement capabilities, and a strong focus on exfiltrating sensitive data from diverse industrial control environments.

Key Capabilities

• Remote desktop control via virtual display
• Command execution using PowerShell or command line interpreters
• Credential harvesting from browser & system caches
• File upload/download for exfiltration
• Persistence through registry autorun or scheduled tasks
• Lateral movement across Windows workstations with SMB and RDP

ATT&CK Techniques

Recommended Actions

• Deploy behavior‑based endpoint detection to flag anomalous remote desktop sessions and background services named after Bandook components
• Block known malicious IPs, domains, and file hashes associated with Bandook campaigns via firewall/UTM rules
• Update antivirus signatures covering Delphi/C++ compiled stubs of Bandook
• Implement AppLocker or similar allowlisting techniques for executable paths typical of RAT installations
• Enforce least privilege policies and monitor for unauthorized creation of scheduled tasks
• Conduct regular security awareness training focusing on spear‑phishing scenarios linked to Bandook delivery

Suggested Tags