Specialists from F6 have uncovered a new campaign distributing the Buhtrap RAT remote access trojan. The attackers continue their established tactic of targeting accountants and lawyers with counterfeit professional websites promoted through paid search engine advertisements.
The latest decoy closely replicates the legitimate resource Glavnaya Kniga Bukhgaltera. Visitors arrive seeking a required document and click the download button, only to receive a ZIP archive instead of a harmless file. JavaScript code on the page intercepts the request and dynamically generates a link to the malicious archive, whose filename incorporates the current date and time.
Inside the archive, victims find an executable such as Obrazets dokumenta pod indeksom 1.exe. Upon execution, Buhtrap RAT establishes persistence on the system and connects to the attackers’ command server. The trojan grants remote control over the compromised machine and is deployed in operations against Russian organizations.
Researchers at F6 noted that the infection chain has seen minimal changes compared with the previous campaign. The main update involves refreshed network infrastructure rather than new techniques. Buhtrap has been active since 2014 both as malware and as the name of the associated criminal group. Following the public release of its source code in 2016, the tool became available to various financially motivated threat actors.
Among the identified decoy domains are glavaudit.org, buhotchet.com, and audit24.org. Security experts recommend that users carefully verify website addresses and refrain from launching executable files that masquerade as documents.
