Netskope Threat Labs

Bisonal

ATP Sandbox Adv. Heuristics

Description

Bisonal is a remote access tool that the Tonto Team threat actor has used against public and private sector organizations in Russia, South Korea, and Japan since at least December 2010.

Stats

First seen
April 2022
Last seen
September 2026

MITRE ATT&CK techniques

34 techniques across 9 tactics.

TA0001 Initial Access

TA0002 Execution

TA0003 Persistence

TA0005 Stealth

TA0007 Discovery

  • T1012Query Registry
  • T1016System Network Configuration Discovery
  • T1057Process Discovery
  • T1082System Information Discovery
  • T1083File and Directory Discovery
  • T1124System Time Discovery

TA0009 Collection

  • T1005Data from Local System

TA0011 Command and Control

TA0010 Exfiltration

  • T1041Exfiltration Over C2 Channel

TA0112 Defense Impairment

Associated groups

Alert name variants

Alert Name
Win32.Backdoor.Bisonal
Win32.Trojan.Bisonal

Related families

QakBotKONNIPlugXLatrodectusMetamorfo

References