Bondnet
Bondnet is classified as other threat group.
- Type
- Other threat group
Bondnet is a threat actor that deploys backdoors and cryptocurrency miners. They use high-performance bots as C2 servers and configure reverse RDP environments on compromised systems. Bondnet has infected over 15,000 Windows server machines worldwide, primarily targeting Windows Server 2008 R2 systems. The botnet is used for mining cryptocurrencies like Monero, ByteCoin, RieCoin, and ZCash, potentially earning the operator thousands of dollars per day.
Published reports on this actor:
- https://asec.ahnlab.com/en/66662/
- https://www.akamai.com/blog/security/the-bondnet-army
- https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/
Source: MISP Galaxy, Malpedia.
Is your organization mentioned?
Search with your domain to check whether your organization appears in ransomware listings, leaked records, forums and Telegram channels.
Search your domainThreat Intelligence
Track ransomware groups, victim posts and indicators of compromise, and see the records that match your own assets.