Buhtrap
Attribution profile
- Type
- Spy
- Location
- Russia
- Known incidents
- 1 incident
- Sources
- 1 source
- First seen
- 2015-10-26
- Last seen
- 2015-10-26
- Updated
- 2026-10-13 13:12
- Aliases
- 2 aliases
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
The Buhtrap threat actor, also known as the Buhtrap gang and based in Russia, is noted for compromising legitimate software distribution channels to spread its Buhtrap malware. In the publicly reported Operation Buhtrap campaign, the actor bundled the malware with the free version of Ammyy Admin remote‑administration software, using an NSIS installer that employed DLL sideloading to establish command‑and‑control communication while performing system espionage and keystroke logging. The attack leveraged the wide adoption of Ammyy Admin to deliver multiple malicious payloads through shared droppers, with specific file hashes and a revoked Comodo certificate identified by researchers. No further details on the actor’s targeting of particular sectors, financial motives, or affiliations with state or criminal groups are provided in the available sources.
Incidents
Attributed incidents are available to members.
1 incidentSources
Sources available to members: 1 source.