BoomBox

Description

BoomBox is a downloader responsible for executing next stage components that cyberattackers associated with APT29 have used since at least 2021. Detections under this name indicate sophisticated activity and warrant escalation beyond routine malware handling.

Stats

First seen: March 2022
Last seen: October 2026

MITRE ATT&CK techniques

16 techniques across 6 tactics.

TA0002 Execution

T1204User Execution
- T1204.002Malicious File

TA0003 Persistence

T1547Boot or Logon Autostart Execution
- T1547.001Registry Run Keys / Startup Folder

TA0005 Stealth

T1027Obfuscated Files or Information
T1036Masquerading
T1140Deobfuscate/Decode Files or Information
T1218System Binary Proxy Execution
- T1218.011Rundll32
T1480Execution Guardrails

TA0007 Discovery

T1033System Owner/User Discovery
T1082System Information Discovery
T1083File and Directory Discovery
T1087Account Discovery
- T1087.002Domain Account
- T1087.003Email Account

TA0011 Command and Control

T1071Application Layer Protocol
- T1071.001Web Protocols
T1102Web Service
T1105Ingress Tool Transfer

TA0010 Exfiltration

T1567Exfiltration Over Web Service
- T1567.002Exfiltration to Cloud Storage

Associated groups

G0016APT29

Alert name variants

Alert Name	Engine
ByteCode-MSIL.Trojan.BoomBox	ATP Sandbox Adv. Heuristics
Win32.Trojan.BoomBox	ATP Sandbox Adv. Heuristics

Related families

Latrodectus Raspberry Robin TrickBot InvisiMole QakBot