{
  "name": "Bulbature, beneath the waves of GobRAT",
  "slug": "bulbature-beneath-the-waves-of-gobrat",
  "description": "This report examines an infrastructure used to control compromised edge devices transformed into Operational Relay Boxes for launching cyber attacks. The infrastructure, consisting of 63 identified servers, uses GobRAT and Bulbature malware to compromise devices and create a botnet. Features include automated exploitation, DDoS capabilities, and proxy creation. Evidence points to Chinese origin, with targeting focused on North America. The botnet comprised nearly 75,000 compromised devices as of July 2023, primarily Linux routers with ARM architecture. The sophisticated obfuscation and constant evolution of the malware since 2022 demonstrate the operators' intent to conceal their activities and maintain long-term access.",
  "published": "2024-10-04T08:11:56+00:00",
  "created_at": "2024-10-04T08:11:56+00:00",
  "modified_at": "2024-10-04T10:41:04+00:00",
  "created_at_opencti": "2024-10-04T08:11:56+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2024-10-04",
    "botnet",
    "bulbature",
    "china",
    "ddos",
    "edge devices",
    "gobrat",
    "orb",
    "proxy"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "91.196.70.165"
      },
      {
        "id": "",
        "name": "78.141.218.239"
      },
      {
        "id": "",
        "name": "68.183.89.48"
      },
      {
        "id": "",
        "name": "67.219.101.151"
      },
      {
        "id": "",
        "name": "64.227.130.48"
      },
      {
        "id": "",
        "name": "64.176.56.252"
      },
      {
        "id": "",
        "name": "64.176.49.89"
      },
      {
        "id": "",
        "name": "64.176.47.133"
      },
      {
        "id": "",
        "name": "5.34.178.144"
      },
      {
        "id": "",
        "name": "64.176.228.78"
      },
      {
        "id": "",
        "name": "47.96.119.186"
      },
      {
        "id": "",
        "name": "5.34.176.150"
      },
      {
        "id": "",
        "name": "45.77.34.148"
      },
      {
        "id": "",
        "name": "45.76.177.40"
      },
      {
        "id": "",
        "name": "45.32.33.92"
      },
      {
        "id": "",
        "name": "45.76.154.241"
      },
      {
        "id": "",
        "name": "38.60.223.81"
      },
      {
        "id": "",
        "name": "38.60.223.208"
      },
      {
        "id": "",
        "name": "38.60.223.51"
      },
      {
        "id": "",
        "name": "38.60.221.63"
      },
      {
        "id": "",
        "name": "38.60.221.32"
      },
      {
        "id": "",
        "name": "38.60.221.174"
      },
      {
        "id": "",
        "name": "38.60.221.145"
      },
      {
        "id": "",
        "name": "38.60.212.233"
      },
      {
        "id": "",
        "name": "38.60.212.167"
      },
      {
        "id": "",
        "name": "38.60.212.13"
      },
      {
        "id": "",
        "name": "38.60.206.78"
      },
      {
        "id": "",
        "name": "38.60.203.83"
      },
      {
        "id": "",
        "name": "38.60.203.61"
      },
      {
        "id": "",
        "name": "38.60.203.167"
      },
      {
        "id": "",
        "name": "38.60.203.21"
      },
      {
        "id": "",
        "name": "38.60.203.141"
      },
      {
        "id": "",
        "name": "38.60.196.86"
      },
      {
        "id": "",
        "name": "38.60.134.236"
      },
      {
        "id": "",
        "name": "38.54.88.248"
      },
      {
        "id": "",
        "name": "38.54.85.70"
      },
      {
        "id": "",
        "name": "38.54.85.246"
      },
      {
        "id": "",
        "name": "38.54.85.244"
      },
      {
        "id": "",
        "name": "38.54.85.21"
      },
      {
        "id": "",
        "name": "38.54.85.178"
      },
      {
        "id": "",
        "name": "38.54.56.5"
      },
      {
        "id": "",
        "name": "38.54.85.164"
      },
      {
        "id": "",
        "name": "38.54.56.45"
      },
      {
        "id": "",
        "name": "38.54.50.253"
      },
      {
        "id": "",
        "name": "38.54.50.163"
      },
      {
        "id": "",
        "name": "38.54.50.120"
      },
      {
        "id": "",
        "name": "38.180.9.2"
      },
      {
        "id": "",
        "name": "38.180.74.236"
      },
      {
        "id": "",
        "name": "38.180.74.228"
      },
      {
        "id": "",
        "name": "38.180.74.180"
      },
      {
        "id": "",
        "name": "38.180.74.173"
      },
      {
        "id": "",
        "name": "38.180.74.14"
      },
      {
        "id": "",
        "name": "38.180.29.229"
      },
      {
        "id": "",
        "name": "38.180.29.5"
      },
      {
        "id": "",
        "name": "38.180.191.118"
      },
      {
        "id": "",
        "name": "38.180.189.108"
      },
      {
        "id": "",
        "name": "38.180.188.92"
      },
      {
        "id": "",
        "name": "38.180.128.52"
      },
      {
        "id": "",
        "name": "38.180.106.179"
      },
      {
        "id": "",
        "name": "38.180.106.12"
      },
      {
        "id": "",
        "name": "207.148.69.74"
      },
      {
        "id": "",
        "name": "207.148.125.75"
      },
      {
        "id": "",
        "name": "195.80.148.142"
      },
      {
        "id": "",
        "name": "188.116.22.59"
      },
      {
        "id": "",
        "name": "178.128.96.236"
      },
      {
        "id": "",
        "name": "176.97.73.215"
      },
      {
        "id": "",
        "name": "176.97.73.199"
      },
      {
        "id": "",
        "name": "176.97.73.171"
      },
      {
        "id": "",
        "name": "158.247.223.125"
      },
      {
        "id": "",
        "name": "154.90.63.215"
      },
      {
        "id": "",
        "name": "154.90.63.156"
      },
      {
        "id": "",
        "name": "154.90.62.247"
      },
      {
        "id": "",
        "name": "154.90.62.201"
      },
      {
        "id": "",
        "name": "154.223.21.181"
      },
      {
        "id": "",
        "name": "154.223.21.80"
      },
      {
        "id": "",
        "name": "154.223.21.160"
      },
      {
        "id": "",
        "name": "154.223.21.16"
      },
      {
        "id": "",
        "name": "154.223.20.215"
      },
      {
        "id": "",
        "name": "154.205.155.3"
      },
      {
        "id": "",
        "name": "154.205.137.248"
      },
      {
        "id": "",
        "name": "154.205.136.160"
      },
      {
        "id": "",
        "name": "154.205.128.210"
      },
      {
        "id": "",
        "name": "154.205.128.194"
      },
      {
        "id": "",
        "name": "141.164.47.248"
      },
      {
        "id": "",
        "name": "140.82.38.225"
      },
      {
        "id": "",
        "name": "139.84.230.198"
      },
      {
        "id": "",
        "name": "139.84.227.52"
      },
      {
        "id": "",
        "name": "139.84.177.244"
      },
      {
        "id": "",
        "name": "139.84.174.102"
      },
      {
        "id": "",
        "name": "139.84.167.48"
      },
      {
        "id": "",
        "name": "139.84.170.90"
      },
      {
        "id": "",
        "name": "139.84.163.73"
      },
      {
        "id": "",
        "name": "139.84.147.229"
      },
      {
        "id": "",
        "name": "139.59.80.77"
      },
      {
        "id": "",
        "name": "139.180.212.224"
      },
      {
        "id": "",
        "name": "139.180.200.78"
      },
      {
        "id": "",
        "name": "139.180.139.12"
      },
      {
        "id": "",
        "name": "108.61.127.186"
      },
      {
        "id": "",
        "name": "103.57.248.40"
      },
      {
        "id": "",
        "name": "104.238.176.171"
      },
      {
        "id": "",
        "name": "38.180.106.167"
      },
      {
        "id": "",
        "name": "nbt201.dynamic-dns.net"
      },
      {
        "id": "",
        "name": "eyh.ocry.com"
      },
      {
        "id": "",
        "name": "b1c21264a60edb64895c8c61507211a829f13068541f875b615e6c1c363122ba"
      },
      {
        "id": "",
        "name": "a6d184715cbb596edac024089ae493785ba3c4519b493946c8f850b4bd08836c"
      },
      {
        "id": "",
        "name": "91eaa94223c12ddc89eca5220a8c57f0254f587f73c9edc161fc161a56e2c2f0"
      },
      {
        "id": "",
        "name": "869a6cd8205af5ec1bf04e6abf0ff79f12e62a8eeae129b9e219e1179520bac3"
      },
      {
        "id": "",
        "name": "743e15f8cfd54077406635bea803b26c574b1b5c3862b132779a8cf52d9ef903"
      },
      {
        "id": "",
        "name": "726ac8f88c4585ccb2ce2e3325726230dc7bd2c7f6667085ac2f665c4ce3fb46"
      },
      {
        "id": "",
        "name": "676cf55076127dab1403c3322d38bf72b62f8aaff25534e5af7b02fc1474a9c0"
      },
      {
        "id": "",
        "name": "667dd21bc252eb7d7415fc13ab996575bbe451062d82c94b14d6ba750d95ab64"
      },
      {
        "id": "",
        "name": "6632fe263bf687fb8d46dd29eaf90601350681aa1930a14e2aba2a16f6c3e040"
      },
      {
        "id": "",
        "name": "48b243fd7ed8bc0b7ce663f0b3fc34f07fcf9fb04bf8bceaff8b7453ab4e5318"
      },
      {
        "id": "",
        "name": "41e189a5b68f305ab6251a06475b76777bda0d035ea06cd569306ed5c98bdc98"
      },
      {
        "id": "",
        "name": "27b6567f260dd689200bbda0794341b1edcf6039cfc1ae7adf0bc6477a16a1f9"
      },
      {
        "id": "",
        "name": "3ab014dd8cc7878c4e840be84b111e6fa71de221c42c14b0becaf3827a744ab9"
      },
      {
        "id": "",
        "name": "1f3a0144e717e7d93fe65877b4945a25c03b0722b6761e8fc96c8b5e62be3e46"
      },
      {
        "id": "",
        "name": "173e2f90de78f8288e0172e900693d228ae1071cc80a4fe02a09af6cd37358e9"
      },
      {
        "id": "",
        "name": "141bc0c7413665970cc33ba7b31f8e2ab0d1f9fb0363478aa6d3fd444e6745a4"
      },
      {
        "id": "",
        "name": "0858c36ed2cf29d9f7de3d7b8d595e45d888da422e76bc9c9115a8f25027d5e7"
      }
    ],
    "malware": [
      {
        "id": "1ace8ccb-42c9-414e-af8e-934a28474193",
        "name": "Bulbature",
        "slug": "bulbature"
      },
      {
        "id": "49e64159-d976-4123-b0a9-c5e0daa4aaed",
        "name": "GobRAT",
        "slug": "gobrat"
      }
    ],
    "attack_patterns": [
      {
        "id": "7ec3a60f-8eaa-4766-ab47-1a220616a29c",
        "name": "T1584.004"
      },
      {
        "id": "e87116ac-f56b-4b15-a5e2-a4ed737555d5",
        "name": "T1543.002"
      },
      {
        "id": "7e5fbc10-b908-4ce8-8ba8-9fd70790c6ae",
        "name": "T1562.004"
      },
      {
        "id": "3e7e47ba-d8ad-4aa8-a4fc-1167cec2e125",
        "name": "T1587.001"
      },
      {
        "id": "6a146066-5a78-493c-a26a-133b62c1149e",
        "name": "T1588.002"
      },
      {
        "id": "7616ff60-a18f-4663-9824-b889aa01c8ce",
        "name": "T1588"
      },
      {
        "id": "5e3b3612-8bf8-46e1-943e-b4c1524bef11",
        "name": "T1587"
      },
      {
        "id": "7911f1c3-e86b-4e33-afea-9a054b0295dc",
        "name": "T1222"
      },
      {
        "id": "3e753709-1776-42f4-b465-278cb5f6ea6b",
        "name": "T1614"
      },
      {
        "id": "32817170-4c07-427e-b8a5-80a733ae2550",
        "name": "T1497"
      },
      {
        "id": "392fef6c-4d5d-4280-bad6-b78751569e7f",
        "name": "T1222.002"
      },
      {
        "id": "dc17cbbd-40d8-43cf-b3cf-50d1276db2c7",
        "name": "T1016"
      },
      {
        "id": "70616b2f-4019-4963-b758-5d9f6f20e201",
        "name": "T1082"
      },
      {
        "id": "c473a756-355a-42ad-a0df-cd3a8fa006d1",
        "name": "T1057"
      },
      {
        "id": "45082a8e-9c79-470e-ad1b-decac7188e8f",
        "name": "T1083"
      },
      {
        "id": "dc342445-1b78-48b4-aa06-89ed2ad7c28e",
        "name": "T1071"
      },
      {
        "id": "d570881a-1f73-41ca-ad6c-fc29256c76f9",
        "name": "T1595"
      },
      {
        "id": "af9ed2e3-4663-4723-beab-c606ddc312e0",
        "name": "T1543"
      },
      {
        "id": "0156fcda-e385-4662-b388-086c3e16feec",
        "name": "T1140"
      },
      {
        "id": "0c836307-129e-4ff7-a532-180c633cacba",
        "name": "T1027"
      },
      {
        "id": "09124a92-c11f-4571-b35b-ab0bce6dd081",
        "name": "T1112"
      },
      {
        "id": "c340d47a-2ea8-41ca-9a0b-a72559b89bbf",
        "name": "T1584"
      },
      {
        "id": "fcd96dc0-500e-4354-bd97-5c65718a9004",
        "name": "T1562"
      },
      {
        "id": "6c8f8a40-2746-4a37-86bd-81e82afa6e62",
        "name": "T1190"
      },
      {
        "id": "b9eab970-53dd-4977-9a26-c4fe566e422d",
        "name": "T1133"
      }
    ],
    "vulnerabilities": [
      {
        "id": "",
        "name": "CVE-2019-13956"
      },
      {
        "id": "",
        "name": "CVE-2019-9082"
      },
      {
        "id": "",
        "name": "CVE-2017-5638"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "Sweden"
      },
      {
        "id": "",
        "name": "Hong Kong"
      },
      {
        "id": "",
        "name": "Singapore"
      },
      {
        "id": "",
        "name": "Taiwan"
      },
      {
        "id": "",
        "name": "Italy"
      },
      {
        "id": "",
        "name": "Canada"
      },
      {
        "id": "",
        "name": "Germany"
      },
      {
        "id": "",
        "name": "United Kingdom of Great Britain and Northern Ireland"
      },
      {
        "id": "",
        "name": "United States of America"
      }
    ]
  },
  "external_refs": [
    "https://blog.sekoia.io/bulbature-beneath-the-waves-of-gobrat/",
    "https://otx.alienvault.com/pulse/66ffbf6cca559df8ceb26fb5"
  ]
}