- Category
- Tracked, unattributed · A vendor’s working cluster, not yet attributed.
- Origin
- Unknown
- Sources
- 4 sources carry it
- Identifier
- GINC-APT-0495 · boolka
What it is
Boolka is a threat actor known for infecting websites with malicious JavaScript scripts for data exfiltration. They have been carrying out opportunistic SQL injection attacks since at least 2022. Boolka has developed a malware delivery platform based on the BeEF framework and has been distributing the BMANAGER trojan. Their activities demonstrate a progression from basic website infections to more sophisticated malware operations.
Tools
The tools and malware families the sources tie to it.
- Trojan.Karagany
- Trojan.Mebromi
Sources
- Malpedia malpedia.caad.fkie.fraunhofer.de