Threat Intelligence Tarot
pentacles · 13
Criminal (TrickBot operators - Russian-speaking)
G0102★★★★★
risk 4/5
✦ The Side Door ✦
BazaLoader
BazarLoader · Team9 · Gold Ulrick
HealthcareLaw firmsFinancial servicesEnterprise networks globally
Active since ~2020 · Initial access as a service, Ryuk and Conti ransomware delivery, Enterprise network access
It emails a fake subscription renewal notice. You call the number to cancel. A call center employee walks you through downloading a file to 'process the cancellation.' The Side Door is one of the most creative initial access techniques documented - it weaponized customer service and deployed call centers for cybercrime.
Tactics & Techniques
RCN
RDV
INI
EXC
PRS
PRV
EVA
CRD
DSC
LAT
COL
C2
EXF
IMP
Notable Operations
- ◆Fake subscription cancellation call-back scam delivering BazaLoader
- ◆Human-operated call centers for social engineering at scale
- ◆Ryuk ransomware delivery through BazaLoader access
- ◆Healthcare sector penetrations during COVID-19 pandemic
Defenses
- ▸User awareness training for fake subscription cancellation scamsNIST SP 800-50 ↗
- ▸Application execution controls - block unsigned or unrecognized executablesCIS Control 2 ↗
- ▸Browser isolation for high-risk web browsingCIS Control 9 ↗
- ▸Endpoint monitoring for BazaLoader behavioral indicatorsNIST CSF: DE.CM ↗
Reversed: Their Weakness
BazaLoader's call-center social engineering model created unusual evidence trails - phone records, voice recordings, and payment processing for the call centers helped law enforcement identify operators in ways purely technical operations do not generate.
Share this adversary profile
Compare →swipe to browse
Related Adversaries
Data sourced from MITRE ATT&CK. For educational purposes.