Bazar
Software · ATTACK:enterprise:S0534
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0534",
"title": "Bazar",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0534",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--99fdf3b4-96ef-4ab9-b191-fc683441cad0",
"external_id": "S0534",
"domain": "enterprise",
"created": "2020-11-18T19:07:48.008Z",
"modified": "2023-12-04T19:42:13.073Z",
"version": "2.0",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "Team9"
},
{
"source_name": "KEGTAP"
},
{
"source_name": "Bazaloader"
},
{
"source_name": "Cybereason Bazar July 2020",
"url": "https://www.cybereason.com/blog/a-bazar-of-tricks-following-team9s-development-cycles"
},
{
"source_name": "FireEye KEGTAP SINGLEMALT October 2020",
"url": "https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html"
},
{
"source_name": "Microsoft Ransomware as a Service",
"url": "https://www.microsoft.com/en-us/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/"
},
{
"source_name": "NCC Group Team9 June 2020",
"url": "https://research.nccgroup.com/2020/06/02/in-depth-analysis-of-the-new-team9-malware-family/"
},
{
"source_name": "CrowdStrike Wizard Spider October 2020",
"url": "https://www.crowdstrike.com/blog/wizard-spider-adversary-update/"
}
]
}Explicit source assertions (54)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G1011 → uses → ATTACK:enterprise:S0534
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0277787b-6419-4371-aa5d-77b2d0cc025f
Google EXOTIC LILY March 2022ATTACK:enterprise:S0534 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0a2c9965-291c-4724-829b-3cd5e8b26b58
Cybereason Bazar July 2020 · NCC Group Team9 June 2020ATTACK:enterprise:S0534 → uses → ATTACK:enterprise:T1482
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--120f001f-eb9c-4183-89f1-7c6e4bddc80c
Cybereason Bazar July 2020 · NCC Group Team9 June 2020ATTACK:enterprise:S0534 → uses → ATTACK:enterprise:T1573.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1495ec37-a51f-4a50-8c01-427d7c4bb009
Zscaler Bazar September 2020ATTACK:enterprise:S0534 → uses → ATTACK:enterprise:T1087.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1685aa0e-d1be-40ea-ade0-21ff64e0d372
NCC Group Team9 June 2020 · DFIR Ryuk's Return October 2020ATTACK:enterprise:S0534 → uses → ATTACK:enterprise:T1018
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--16d19ac1-de53-44e2-9139-32b0e0525b0c
Cybereason Bazar July 2020ATTACK:enterprise:S0534 → uses → ATTACK:enterprise:T1204.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--17e7193e-6583-4bae-8a17-de75f006cd36
Cybereason Bazar July 2020 · Zscaler Bazar September 2020 · CrowdStrike Wizard Spider October 2020ATTACK:enterprise:S0534 → uses → ATTACK:enterprise:T1135
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--203108df-424d-4dfe-ac45-3cbd84c71615
NCC Group Team9 June 2020ATTACK:enterprise:S0534 → uses → ATTACK:enterprise:T1055
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--227624a1-7dda-4691-89b3-49336aa68bfa
Cybereason Bazar July 2020ATTACK:enterprise:S0534 → uses → ATTACK:enterprise:T1197
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2296f1da-0910-46ee-81f7-5d10cb8753cd
NCC Group Team9 June 2020ATTACK:enterprise:S0534 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--26f6de28-984d-4f79-9806-c13fe9e1f42d
Cybereason Bazar July 2020 · Zscaler Bazar September 2020ATTACK:enterprise:S0534 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2cd5235f-1f0b-4f58-a931-d3b940b62cbf
NCC Group Team9 June 2020 · CrowdStrike Wizard Spider October 2020ATTACK:enterprise:S0534 → uses → ATTACK:enterprise:T1027.013
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2e0eb5e4-37a3-435d-bdac-01f72b8cec4c
Cybereason Bazar July 2020 · NCC Group Team9 June 2020 · CrowdStrike Wizard Spider October 2020ATTACK:enterprise:S0534 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2fdc9078-0737-4b2c-bb6c-f046b63c368b
Cybereason Bazar July 2020ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:S0534
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4bac5bdb-493b-4c32-882d-ce77786d12c9
Microsoft Ransomware as a Service · CrowdStrike Wizard Spider October 2020ATTACK:enterprise:S0534 → uses → ATTACK:enterprise:T1497
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4d63c2b7-03e6-4747-81f2-9197faccd5fc
Cybereason Bazar July 2020ATTACK:enterprise:S0534 → uses → ATTACK:enterprise:T1055.013
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--506751ad-9b0d-4dc5-a6a5-b25521e66a1a
Cybereason Bazar July 2020 · NCC Group Team9 June 2020ATTACK:enterprise:S0534 → uses → ATTACK:enterprise:T1070.009
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--50d9747b-7dee-4daf-8611-b4190ecd7e35
NCC Group Team9 June 2020ATTACK:enterprise:S0534 → uses → ATTACK:enterprise:T1005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--602a4664-e89c-4c11-982d-699589853ab3
Cybereason Bazar July 2020ATTACK:enterprise:S0534 → uses → ATTACK:enterprise:T1027.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--671e9da1-ef79-4193-88e2-fb406304ccea
Cybereason Bazar July 2020 · NCC Group Team9 June 2020ATTACK:enterprise:S0534 → uses → ATTACK:enterprise:T1614.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--682dad6a-277f-46ae-8416-cba070ff5738
NCC Group Team9 June 2020ATTACK:enterprise:S0534 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6d9f427b-f016-4100-a30a-c13648536e81
Cybereason Bazar July 2020 · NCC Group Team9 June 2020ATTACK:enterprise:S0534 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6e6f67c0-ba84-48f2-a322-2a7cb7a5cd02
Cybereason Bazar July 2020ATTACK:enterprise:S0534 → uses → ATTACK:enterprise:T1104
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--711879b6-a9ac-42c6-a6a0-244b03890cec
Cybereason Bazar July 2020 · Zscaler Bazar September 2020ATTACK:enterprise:S0534 → uses → ATTACK:enterprise:T1012
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--75a3cfad-a9e7-453f-88b8-787304575a33
Cybereason Bazar July 2020 · NCC Group Team9 June 2020ATTACK:enterprise:S0534 → uses → ATTACK:enterprise:T1036.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--78ba82a1-e803-42c1-b112-ce999369d348
Cybereason Bazar July 2020 · NCC Group Team9 June 2020 · CrowdStrike Wizard Spider October 2020ATTACK:enterprise:S0534 → uses → ATTACK:enterprise:T1518
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--794403a3-232e-4cc3-85e2-cc997825dfa8
Cybereason Bazar July 2020ATTACK:enterprise:S0534 → uses → ATTACK:enterprise:T1573.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7a41dd37-a5a0-4469-9ed9-74eb8ac57af3
NCC Group Team9 June 2020ATTACK:enterprise:S0534 → uses → ATTACK:enterprise:T1547.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8dd22b15-a9bb-4acc-8fac-e366756ab50b
Zscaler Bazar September 2020ATTACK:enterprise:S0534 → uses → ATTACK:enterprise:T1036.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9c2766b3-87ff-4ec7-9ff4-faa3d4572eb4
Cybereason Bazar July 2020ATTACK:enterprise:S0534 → uses → ATTACK:enterprise:T1016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9d4f2e79-594d-45b9-86d7-9dcc640ad9f1
Cybereason Bazar July 2020ATTACK:enterprise:S0534 → uses → ATTACK:enterprise:T1497.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--adbee939-28b3-4932-9e8d-992b7fdca835
NCC Group Team9 June 2020ATTACK:enterprise:S0534 → uses → ATTACK:enterprise:T1033
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b609347d-0089-4021-86a6-706ef1abc95e
NCC Group Team9 June 2020ATTACK:enterprise:S0534 → uses → ATTACK:enterprise:T1553.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b8dc82ba-2bd6-4299-bf36-9d5968810663
Cybereason Bazar July 2020ATTACK:enterprise:S0534 → uses → ATTACK:enterprise:T1070.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bf61da0b-036b-4e51-894f-71a73689cff4
NCC Group Team9 June 2020ATTACK:enterprise:S0534 → uses → ATTACK:enterprise:T1008
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c1d43be1-daea-4cdd-9632-e0a22f4d9073
NCC Group Team9 June 2020ATTACK:enterprise:S0534 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c2e67b83-b3c3-4db4-a18e-74f1cf005132
Cybereason Bazar July 2020 · DFIR Conti Bazar Nov 2021 · NCC Group Team9 June 2020ATTACK:enterprise:S0534 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c36deed2-7da5-4c41-b6f0-eebc94bb17e9
Cybereason Bazar July 2020 · Zscaler Bazar September 2020 · CrowdStrike Wizard Spider October 2020ATTACK:enterprise:S0534 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c646d6ed-e0f6-48b0-a4a3-d52b0a21f250
Cybereason Bazar July 2020 · Zscaler Bazar September 2020 · NCC Group Team9 June 2020 · CrowdStrike Wizard Spider October 2020ATTACK:enterprise:S0534 → uses → ATTACK:enterprise:T1087.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cc81f8f0-111c-4932-bc75-7704eaf17f73
NCC Group Team9 June 2020ATTACK:enterprise:S0534 → uses → ATTACK:enterprise:T1685
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ce2d78ae-469f-434a-8324-88237240915f
NCC Group Team9 June 2020ATTACK:enterprise:S0534 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cff83f53-0e10-4e98-9e2e-2a4b7d027d70
Cybereason Bazar July 2020 · NCC Group Team9 June 2020ATTACK:enterprise:S0534 → uses → ATTACK:enterprise:T1102
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d5f0ff09-374d-45f6-b7d8-45466bf0ecf0
Cybereason Bazar July 2020 · Zscaler Bazar September 2020ATTACK:enterprise:S0534 → uses → ATTACK:enterprise:T1036.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d667c620-28cb-4c86-83f7-33d6c154369c
Cybereason Bazar July 2020ATTACK:enterprise:S0534 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d9e7b8b3-6275-4c26-b9d2-4adfa1143c1b
Cybereason Bazar July 2020 · NCC Group Team9 June 2020ATTACK:enterprise:S0534 → uses → ATTACK:enterprise:T1047
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e3cd7b09-c244-4b5e-9a99-f1431489ed49
Cybereason Bazar July 2020 · DFIR Ryuk's Return October 2020ATTACK:enterprise:C0015 → uses → ATTACK:enterprise:S0534
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e508222c-c080-46bd-940d-2ed392382546
DFIR Conti Bazar Nov 2021ATTACK:enterprise:S0534 → uses → ATTACK:enterprise:T1055.012
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ea187577-25ce-458f-a26b-9ee71d3879fd
Cybereason Bazar July 2020 · NCC Group Team9 June 2020ATTACK:enterprise:S0534 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ea40d7a0-bb12-4ed1-a5bd-efdc6bdad4b2
Cybereason Bazar July 2020ATTACK:enterprise:S0534 → uses → ATTACK:enterprise:T1547.009
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ed61e0a2-f6a7-43b1-b58e-aa0ab9c51c4e
Cybereason Bazar July 2020 · NCC Group Team9 June 2020ATTACK:enterprise:S0534 → uses → ATTACK:enterprise:T1547.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f373c8d3-3182-4977-b333-87493458d340
Cybereason Bazar July 2020 · NCC Group Team9 June 2020ATTACK:enterprise:S0534 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f6f600fd-796d-4f1f-b2c6-0ca283b2cdb1
Cybereason Bazar July 2020 · NCC Group Team9 June 2020ATTACK:enterprise:S0534 → uses → ATTACK:enterprise:T1027.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f8f63dca-91a1-4bbf-811c-4ed083b36246
Cybereason Bazar July 2020 · Zscaler Bazar September 2020ATTACK:enterprise:S0534 → uses → ATTACK:enterprise:T1568.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fbc1faff-226a-4ea3-a08a-81b64066496d
Cybereason Bazar July 2020