BONDUPDATER
- ID
- S0360
- Type
- Malware
- Platforms
- Windows
- Source
- attack.mitre.org
- MITRE last modified
- 25 Apr 2025
BONDUPDATER is a PowerShell backdoor used by OilRig. It was first observed in November 2017 during targeting of a Middle Eastern government organization, and an updated version was observed in August 2018 being used to target a government organization with spearphishing emails.[1][2]
Techniques used (7)
- T1053.005 Scheduled Task
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1071.004 DNS
- T1105 Ingress Tool Transfer
- T1564.003 Hidden Window
- T1568.002 Domain Generation Algorithms