Termination-Themed Lures Push Bazar and Buer Malware
An active spear phishing campaign is weaponizing fears about job security to trick employees into downloading malware. The attackers send emails that falsely claim the recipient has been terminated or received customer complaints, using the economic uncertainty of the pandemic to make the threats more plausible. Clicking the embedded link eventually leads to infection with Bazar or Buer malware, delivered through Trickbot.
According to researchers at Zscaler ThreatLabZ, this marks the first observed instance of Bazar and Buer appearing together in a single campaign. The operation is attributed to the Trickbot gang, which has a history of combining various malware families and botnets for its attacks.
Trickbot began as a banking trojan that hijacked browser sessions at financial sites, but has been repurposed over time for other goals, including ransomware delivery. That capability makes it a serious concern for critical infrastructure, especially with the 2020 U.S. presidential election approaching. The malware's operators could theoretically compromise voting systems or disrupt entire polling locations, undermining confidence in election results.
Several disruption efforts were mounted against Trickbot in the fall of 2020. An operation believed to have started on September 22, possibly conducted by U.S. Cyber Command, forced botnet controllers to issue bogus configurations. These swapped real controller IP addresses with the localhost address (127.0.0.1), preventing bots from receiving commands. A second similar attempt followed on October 1. Microsoft also took action, obtaining a court order to disable Trickbot IP addresses and later reporting that 62 of 69 Trickbot servers had been taken down, with the remaining seven being unusual IoT devices.
These countermeasures were expected to have limited long-term effect, as Trickbot relies on decentralized infrastructure that communicates over Tor, with blockchain-based EmerDNS as a takedown-resistant fallback. Reports also indicated that Trickbot controllers were starting to host malware on other cybercriminals' servers to stay operational.
Shortly after these disruption attempts, Area 1 Security identified the current phishing wave delivering Bazar and Buer payloads. The researchers noted that the Bazar loader aborts the infection if the victim's device locale is set to Russia, a common tactic associated with Trickbot. Cyber security researchers believe the group operates out of Russia and has been responsible for a surge of ransomware attacks on U.S. school systems, local governments, and law enforcement agencies since at least 2019.
Cloud Hosting Bypasses Gateway Scans
The phishing messages are minimal and appear to come from authority figures within the target's own company. Two example messages are shown below.
Where does this fearsome material come from? This is placeholder filler.
Rather than attaching malware directly, the emails link out to legitimate cloud services like Google Docs or Constant Contact. This approach sidesteps file-scanning detection in email gateways and makes it harder for URL filtering to catch the threat. If a link gets flagged, the attacker can quickly spin up a new one on the same cloud platforms.
The Google Docs or Constant Contact link leads to a decoy page asking the victim to open a list of terminated employees. The decoy conveniently includes a "If download does not start, click here" prompt, which is where the actual malware is hosted.
Infection Chain Unpacked
Clicking the download link presents the victim with a dialog box to run a file. That file is a malicious PE32+ executable designed for all Windows systems.
Once executed, the PE32+ binary decrypts its payload using an RC4 cipher, with a different RC4 key used for each iteration of the malware. The decrypted payload is a copy of Trickbot.
Area 1 Security researchers spotted the string "dave" at the end of the Trickbot payload in memory—a signature consistent with prior reporting on packing techniques used by Emotet and Trickbot developers. This string indicates a custom packer was used to compress and encrypt the file, complicating reverse-engineering efforts.
Trickbot then decrypts and runs the BazarLoader, which is designed to establish an initial foothold while loading minimal functionality to avoid detection. The BazarLoader attempts to download the Bazar backdoor through a blockchain DNS lookup table, using EmerDNS TLDs like .bazar rather than conventional DNS infrastructure. This approach avoids the need for traditional ISPs and makes takedown efforts more challenging.
To fetch the backdoor, the loader cycles through eight unique IP addresses and five domains under the .bazar TLD. The second-level domains are made up of 12 alphabetical characters generated by a specific domain generation algorithm. The malware runs through these domains to find one still actively hosting the backdoor.
Once the backdoor is installed, the attacker can remotely execute commands, exfiltrate data, and deploy additional payloads such as CobaltStrike or Ryuk ransomware. In one documented case, a Bazar infection led to a domain-wide Ryuk ransomware outbreak just five hours after the initial phishing email was sent, with the attackers exploiting a recently disclosed privilege-escalation vulnerability.
Detection and Defense
This campaign is difficult to catch with traditional security tools. Linking to legitimate cloud services inside the phishing email evades email scanners, and the use of EmerDNS TLDs makes sinkholing and takedown actions largely ineffective. Signature-based defenses lag behind campaigns that routinely regenerate URLs and update payload infrastructure.
Organizations should treat termination-themed emails as suspicious, especially when they arrive with cloud-hosted links. Security teams should also monitor for outbound DNS queries to .bazar TLDs and unusual connections on port 53, as these are indicators that the BazarLoader is attempting to establish communication with its command-and-control infrastructure.
