Buterat Backdoor Campaigns Targeting Enterprise Endpoint Control

Buterat backdoor campaigns are targeting enterprise endpoint control, with the threat described as a covert, persistent backdoor designed to provide remote access and enable lateral movement. The article notes it was first identified in targeted attacks against enterprise and government networks, commonly spreading through phishing campaigns, malicious attachments, or trojanised software downloads.

Static and dynamic analyses reveal the sample is compiled with Borland Delphi, has an entry point at 0x00410AD8, and drops multiple loadable executables in C:\\Users\\Admin (amhost.exe, bmhost.exe, cmhost.exe, dmhost.exe, and lqL1gG.exe). It also highlights encrypted and obfuscated strings, and API calls such as SetThreadContext and ResumeThread used to hijack threads for stealthy payload delivery.

The malware contacts a remote C2 server hidden behind ginomp3.mooo[.]com, employing encryption and obfuscation to blend traffic into legitimate outbound flows. Detection guidelines call for behavioural analysis, memory analysis, and monitoring for the dropped files and for SetThreadContext/ResumeThread usage patterns, as well as blocking outbound connections to the C2 domain. 12 September 2025