BUHTRAP

Overview 29 indicators

No published description. This group is tracked by Maltrail from vendor reporting but is not named in MITRE ATT&CK, so there is no curated profile to show.

Principal sources 9 reports

Ranked by how many of this actor's indicators each report brought in.

• 10cert.gov.ua/article/37246
• 8securelist.ru/buhtrap-strikes-again/90980
• 5welivesecurity.com/2019/07/11/buhtrap-zero-day-espionage-c…
• 5otx.alienvault.com/pulse/5d270b29fccc021c80764db4
• 3securelist.ru/news-buhtrap/89540
• 2twitter.com/c_APT_ure/status/1171102216784158720
• 2virustotal.com/gui/file/2598455a3dc8ff8282adc081f87bce…
• 1otx.alienvault.com/pulse/5cf6846544f75bf827720cb4

Timeline 29 indicators

Each entry is a batch of indicators that appeared upstream on one date, under the report it was filed with.

No indicator matches. Only the most recent 300 are on this page — the rest are in the JSON.

1. 2022-02-21 10 domain4 yrs ago

   cert.gov.ua/article/37246

   alt-2cdn.net

   cs1.wpc-v0cdn.org

   ipv6-wpnc.net

   mail.nais-gov.org

   nais-gov.com

   nais-gov.org

   ns2-dns.com

   ns3-dns.com

   widget.forum-pokemon.com

   wpc-v0cdn.org

   copy batch

2. 2019-09-09 1 url, 1 url_path7 yrs ago

   twitter.com/c_APT_ure/status/1171102216784158720 · virustotal.com/gui/file/2598455a3dc8ff8282adc081f87bce…

   url	http://195.123.227.99
   url_path	/g_38472341.php

   copy batch

3. 2019-07-11 2 domain7 yrs ago

   welivesecurity.com/2019/07/11/buhtrap-zero-day-espionage-c… · otx.alienvault.com/pulse/5d270b29fccc021c80764db4

   corp-microsoft.com

   hdfilm-seyret.com

   copy batch

4. 2019-06-04 1 url7 yrs ago

   securelist.ru/news-buhtrap/89540

   engde.fr/community/viewforum.php

   copy batch

5. 2019-06-04 1 domain7 yrs ago

   otx.alienvault.com/pulse/5cf6846544f75bf827720cb4 · virustotal.com/gui/file/b475f14a1ffdeaf883c73e97724544…

   redmond.corp-microsoft.com

   copy batch

6. 2019-03-25 3 domain7 yrs ago

   welivesecurity.com/2019/07/11/buhtrap-zero-day-espionage-c… · otx.alienvault.com/pulse/5d270b29fccc021c80764db4

   ipv6-microsoft.org

   secure-telemetry.net

   services-glbdns2.com

   copy batch

7. 2018-08-06 8 domain8 yrs ago

   securelist.ru/buhtrap-strikes-again/90980

   allwomens.eu

   avidium.ru.com

   edinstvennaya.eu

   khabmama.eu

   shkolazhizni.eu

   sibmama.eu

   slingshop.ru.com

   zhenskoe-mnenie.eu

   copy batch

8. 2018-08-06 2 url8 yrs ago

   securelist.ru/news-buhtrap/89540

   focus.tula.su/viewforum.php

   topic.penza.su/viewtopic.php

   copy batch

Further reading 9

• virustotal.com/gui/file/b475f14a1ffdeaf883c73e97724544…
• twitter.com/c_APT_ure/status/1171102216784158720
• securelist.ru/news-buhtrap/89540
• otx.alienvault.com/pulse/5d270b29fccc021c80764db4
• welivesecurity.com/2019/07/11/buhtrap-zero-day-espionage-c…
• virustotal.com/gui/file/2598455a3dc8ff8282adc081f87bce…
• otx.alienvault.com/pulse/5cf6846544f75bf827720cb4
• cert.gov.ua/article/37246
• securelist.ru/buhtrap-strikes-again/90980