Live Active security incident? Get immediate response
MITRE ATT&CK® Malware

S0268: Bisonal

Bisonal is a remote access tool (RAT) that has been used by Tonto Team against public and private sector organizations in Russia, South Korea, and Japan since at least December 2010.[1][2]

EnterpriseS0268MalwareObject v2.1 Modified
Glexia's Take

Analyst context for executives and security teams

Analyst confidence High

Bisonal is a Windows remote access tool associated in ATT&CK with long-running espionage activity and use by Tonto Team. Its defensive value is not just “identify this malware,” but validating whether Windows endpoint, network, and registry telemetry can reveal a RAT that performs discovery, command execution, obfuscation, C2 over web or non-application protocols, tool transfer, local data collection, and exfiltration over its command channel.

Executive priority

Prioritize Bisonal as a coverage-validation use case for organizations where Windows endpoints, sensitive local data, or public/private sector operations are material to continuity and confidentiality. Leaders should ask whether SOC and IR teams can reconstruct a remote-access intrusion from host, registry, process, file, and network evidence—not only whether a known hash or signature exists. This object is also useful for audit and risk discussions because ATT&CK links it to data collection and exfiltration behaviors, registry activity, masquerading, and C2 patterns that often determine whether an incident is contained quickly or becomes a broader investigation.

Technical view

For defenders, treat Bisonal as a Windows RAT behavior cluster rather than a single indicator. ATT&CK relationships show use of Windows Command Shell, Visual Basic, Native API execution, registry query and modification, process/system/network/file discovery, file deletion, masquerading, binary padding, software packing, encrypted or encoded files, web-protocol C2, non-application-layer C2, proxying, ingress tool transfer, local data collection, and exfiltration over C2. Validate that endpoint detections correlate suspicious process ancestry, command-line activity, registry reads/writes, unexpected file creation/deletion, packed or padded binaries, and outbound network behavior. Network analytics should account for web traffic blending, encoded C2 content, proxy-mediated paths, and non-application-layer communications where visibility exists.

Likely telemetry

  • Windows endpoint process creation, command-line, parent/child process, and script execution records
  • Windows Registry query and modification events
  • File creation, deletion, rename, path, metadata, and executable inspection telemetry
  • Endpoint alerts or metadata indicating packed, padded, encrypted, encoded, or masqueraded binaries
  • Host discovery command evidence for system, process, network, time, file, and directory enumeration

Detection direction

  • Build detections around behavior chains: discovery followed by registry modification, tool transfer, command execution, C2, local data access, and file deletion is more durable than relying only on static malware identifiers.
  • Tune for Windows-specific evidence because the supplied malware platform is Windows, while some related ATT&CK techniques have broader platform descriptions.
  • Review masquerading and legitimate-name/location abuse carefully; false positives can occur around administrative tools, software installers, and normal system binaries.
  • Inspect encoded or encrypted payload/content and packed binaries as triage leads, not standalone proof of compromise.
  • Correlate outbound web-protocol traffic with host process context; common HTTP/S traffic can hide C2 unless process, destination, timing, and content metadata are available.

Mitigation priorities

  • Confirm baseline Windows hardening, endpoint protection, and logging coverage for process, registry, file, script, and network activity.
  • Restrict and monitor command shell, Visual Basic/script execution, and unnecessary native tool abuse according to business need.
  • Apply least privilege and change-control discipline around Registry modification and executable write locations.
  • Improve egress controls and monitoring for web-protocol C2, unusual protocols, proxy use, and unauthorized file transfer.
  • Strengthen data protection around sensitive local files, including access monitoring and response playbooks for suspected collection and exfiltration.
Analyst notes and limits

The official ATT&CK object identifies Bisonal as a RAT and states it has been used by Tonto Team against public and private sector organizations in Russia, South Korea, and Japan since at least December 2010. ATT&CK provides no official detection text for this malware, so this take derives defensive guidance from the supplied relationships to ATT&CK techniques and the Windows platform field.

No official detection guidance, aliases, labels, or object-level tactics were supplied. Technique relationships describe behaviors associated with the malware but do not prove those behaviors will appear in every incident. Local telemetry, asset criticality, network architecture, and confirmed indicators are required before making exposure, attribution, or impact judgments.

Official MITRE ATT&CK definition

Bisonal

Bisonal is a remote access tool (RAT) that has been used by Tonto Team against public and private sector organizations in Russia, South Korea, and Japan since at least December 2010.[1][2]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

34 rows
Domain ID Name Relationship / procedure
Enterprise T1106 Native API

Bisonal has used the Windows API to communicate with the Service Control Manager to execute a thread.[2]

Enterprise T1070.004 File Deletion Sub-technique

Bisonal will delete its dropper and VBS scripts from the victim’s machine.[1]CitationKaspersky CactusPete Aug 2020[2]

Enterprise T1573.001 Symmetric Cryptography Sub-technique

Bisonal variants reported on in 2014 and 2015 used a simple XOR cipher for C2. Some Bisonal samples encrypt C2 communications with RC4.[1]CitationKaspersky CactusPete Aug 2020[2]

Enterprise T1057 Process Discovery

Bisonal can obtain a list of running processes on the victim’s machine.[1]CitationKaspersky CactusPete Aug 2020[2]

Enterprise T1105 Ingress Tool Transfer

Bisonal has the capability to download files to execute on the victim’s machine.[1]CitationKaspersky CactusPete Aug 2020[2]

Enterprise T1497 Virtualization/Sandbox Evasion

Bisonal can check to determine if the compromised system is running on VMware.[2]

Enterprise T1543.003 Windows Service Sub-technique

Bisonal has been modified to be used as a Windows service.[2]

Enterprise T1137.006 Add-ins Sub-technique

Bisonal has been loaded through a `.wll` extension added to the ` %APPDATA%\microsoft\word\startup\` repository.[2]

Enterprise T1059.005 Visual Basic Sub-technique

Bisonal's dropper creates VBS scripts on the victim’s machine.[1][2]

Enterprise T1140 Deobfuscate/Decode Files or Information

Bisonal has decoded strings in the malware using XOR and RC4.[1][2]

Enterprise T1027.013 Encrypted/Encoded File Sub-technique

Bisonal's DLL file and non-malicious decoy file are encrypted with RC4 and some function name strings are obfuscated.[1][2]

Enterprise T1083 File and Directory Discovery

Bisonal can retrieve a file listing from the system.CitationKaspersky CactusPete Aug 2020[2]

Enterprise T1547.001 Registry Run Keys / Startup Folder Sub-technique

Bisonal has added itself to the Registry key HKEY_CURRENT_USER\Software\Microsoft\CurrentVersion\Run\ for persistence.[1][2]

Enterprise T1005 Data from Local System

Bisonal has collected information from a compromised host.[2]

Enterprise T1497.003 Time Based Checks Sub-technique

Bisonal has checked if the malware is running in a virtual environment with the anti-debug function GetTickCount() to compare the timing.CitationKaspersky CactusPete Aug 2020[2]

Enterprise T1071.001 Web Protocols Sub-technique

Bisonal has used HTTP for C2 communications.[1]CitationKaspersky CactusPete Aug 2020

Enterprise T1112 Modify Registry

Bisonal has deleted Registry keys to clean up its prior activity.[2]

Enterprise T1218.011 Rundll32 Sub-technique

Bisonal has used rundll32.exe to execute as part of the Registry Run key it adds: HKEY_CURRENT_USER \Software\Microsoft\Windows\CurrentVersion\Run\”vert” = “rundll32.exe c:\windows\temp\pvcu.dll , Qszdez”.[1]

Enterprise T1204.002 Malicious File Sub-technique

Bisonal has relied on users to execute malicious file attachments delivered via spearphishing emails.[2]

Enterprise T1027.001 Binary Padding Sub-technique

Bisonal has appended random binary data to the end of itself to generate a large binary.[2]

Enterprise T1566.001 Spearphishing Attachment Sub-technique

Bisonal has been delivered as malicious email attachments.[2]

Enterprise T1132.001 Standard Encoding Sub-technique

Bisonal has encoded binary data with Base64 and ASCII.CitationKaspersky CactusPete Aug 2020[2]

Enterprise T1012 Query Registry

Bisonal has used the RegQueryValueExA function to retrieve proxy information in the Registry.[2]

Enterprise T1027.002 Software Packing Sub-technique

Bisonal has used the MPRESS packer and similar tools for obfuscation.[2]

Enterprise T1041 Exfiltration Over C2 Channel

Bisonal has added the exfiltrated data to the URL over the C2 channel.[2]

Enterprise T1095 Non-Application Layer Protocol

Bisonal has used raw sockets for network communication.[2]

Enterprise T1090 Proxy

Bisonal has supported use of a proxy server.[2]

Enterprise T1059.003 Windows Command Shell Sub-technique

Bisonal has launched cmd.exe and used the ShellExecuteW() API function to execute commands on the system.[1]CitationKaspersky CactusPete Aug 2020[2]

Enterprise T1082 System Information Discovery

Bisonal has used commands and API calls to gather system information.[1]CitationKaspersky CactusPete Aug 2020[2]

Enterprise T1568 Dynamic Resolution

Bisonal has used a dynamic DNS service for C2.[2]

Enterprise T1016 System Network Configuration Discovery

Bisonal can execute ipconfig on the victim’s machine.[1]CitationKaspersky CactusPete Aug 2020[2]

Enterprise T1124 System Time Discovery

Bisonal can check the system time set on the infected host.CitationKaspersky CactusPete Aug 2020

Enterprise T1036.005 Match Legitimate Resource Name or Location Sub-technique

Bisonal has renamed malicious code to `msacm32.dll` to hide within a legitimate library; earlier versions were disguised as `winhelp`.[2]

Enterprise T1036 Masquerading

Bisonal dropped a decoy payload with a .jpg extension that contained a malicious Visual Basic script.[2]

Associated objects

Groups, software, and campaigns

Group Enterprise

G0131: Tonto Team

Tonto Team is a suspected Chinese state-sponsored cyber espionage threat group that has primarily targeted South Korea, Japan, Taiwan, and the United States since at least 2009; by 2020 they expanded operations to include other Asian as well as Eastern European countries. Tonto Team has targeted government, military, energy, mining, financial, education, healthcare, and technology organizations, including through the Heartbeat Campaign (2009-2012) and Operation Bitter Biscuit (2017).[1][2][3][4][5][6]

Relationship explorer

All related ATT&CK context

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .

ATT&CK release
19.1
Object version
2.1
Created
Modified
Raw hash
fa0ae1983029161c...
Imported snapshots across ATT&CK releases (1)
Release Bundle imported Object version Modified Status Raw hash
19.1 2.1 Current bundle fa0ae1983029…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Unit 42 Bisonal July 2018

    Hayashi, K., Ray, V. (2018, July 31). Bisonal Malware Used in Attacks Against Russia and South Korea. Retrieved August 7, 2018.

    Open source URL
  2. [2]
    Talos Bisonal Mar 2020

    Mercer, W., et al. (2020, March 5). Bisonal: 10 years of play. Retrieved January 26, 2022.

    Open source URL
  3. [3]
    Bisonal

    (Citation: Unit 42 Bisonal July 2018)(Citation: Talos Bisonal Mar 2020)

  4. [4]
    mitre-attack S0268
    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.