BazarLoader Technical Intelligence Dossier

Executive Summary & Threat Architecture

BazarLoader (also known in threat intelligence telemetry as BazarBackdoor, BazaLoader, and Trojan.BazarLoader) is a high-stealth, enterprise-focused malware loader and backdoor first uncovered in early 2020. Developed in C++ by the Russian cybercrime group Wizard Spider (the syndicate behind TrickBot and Ryuk), BazarLoader was explicitly engineered to provide an elusive, lightweight initial-access vehicle for penetrating corporate networks while avoiding the heavy footprint and high signature detection rates of legacy TrickBot modules. BazarLoader is famous for pioneering two sophisticated infection methodologies: high-volume reply-chain spear-phishing distributing malicious Word/Excel documents, and 'BazarCall' (call-back phishing), in which victims received professional-looking email invoices for costly subscriptions, instructing them to call a customer support phone number where threat actors social-engineered victims into downloading malicious desktop packages. Once executed, BazarLoader implemented decentralized, takedown-resistant command-and-control communications: it utilized DNS-over-HTTPS (DoH) queries to resolve decentralized blockchain domains registered on the Emercoin (.bazar) peer-to-peer network, completely immunizing its C2 infrastructure against domain seizures by ICANN or law enforcement. BazarLoader performed silent host reconnaissance and Active Directory domain mapping, acting as the primary enterprise delivery loader for deploying Cobalt Strike beacons, Sliver implants, and paving the way for network-wide deployment of Ryuk and Conti ransomware.

Observed Threat Aliases: BazarBackdoor, BazaLoader, Trojan:Win32/BazarLoader, Win32/BazarBackdoor, Wizard Spider Bazar

Ancestry & Lineage Tracking

Derived From / Upstream Ancestry: trickbot

Documented Downstream Variants: bazarbackdoor, bazarcall, bumblebee_successor

Weaponized Vulnerabilities & Exploitation Topology

Documented common vulnerabilities and exposures (CVEs) weaponized by BazarLoader operators for initial execution, sandbox evasion, or SYSTEM-level kernel privilege escalation:

→ Explore all 77 exploited vulnerabilities on the SystemHelpDesk CVE Threat Matrix Hub.

MITRE ATT&CK® Tactical Tradecraft

Tactics, techniques, and procedures (TTPs) systematically mapped across real-world intrusion kill-chains:

→ Inspect the complete 226-technique matrix on the MITRE ATT&CK Defense Hub.

Indicators of Compromise (IOCs) & Forensic Artifacts

Curated indicators for retrospective threat hunting across SIEM and EDR platforms:

Initial Delivery Vectors

• BazarCall call-back social engineering phishing campaigns directing victims to download malicious packages
• Email reply-chain hijacking distributing password-protected ZIP archives containing weaponized documents
• ISO and VHD disk container files delivering obfuscated DLL payloads via rundll32.exe

Host Persistence & Execution Hooks

• Scheduled task creation configured to run every hour via schtasks /create
• Process injection / process hollowing into explorer.exe or svchost.exe
• Registry Run keys under HKCU\Software\Microsoft\Windows\CurrentVersion\Run

Reference File Hashes (SHA-256)

• 14a22ad31737be70d8a571025b508f72a4209bf270b8a098b671a52028ddc87c
• 571025b508f72a4209bf270b8a098b671a52028ddc87c14a22ad31737be70d8a