Description
Buhtrap is a backdoor and ransomware operation that has targeted financial institutions, first in Eastern Europe and later in campaigns against banks and government organizations. The backdoor provides espionage and data theft capabilities on compromised systems, and the same operators have deployed ransomware in financially motivated attacks. Its long history shows a group that blends surveillance and fraud, and it adapts its tooling as targets and opportunities shift.
Stats
- First seen
- April 2022
- Last seen
- October 2026
Alert name variants
| Alert Name |
|---|
| Generic.Ransom.Buhtrap.0351A403 |
| Generic.Ransom.Buhtrap.0802C545 |
| Generic.Ransom.Buhtrap.084FEED4 |
| Generic.Ransom.Buhtrap.0A9A6C49 |
| Generic.Ransom.Buhtrap.16EB2069 |
| Generic.Ransom.Buhtrap.2513DF63 |
| Generic.Ransom.Buhtrap.2543ACBC |
| Generic.Ransom.Buhtrap.40EE887E |
| Generic.Ransom.Buhtrap.42538F31 |
| Generic.Ransom.Buhtrap.43C8B86D |