GINC-APT-0495 · Tracked, unattributed

Boolka

Category
Tracked, unattributed · A vendor’s working cluster, not yet attributed.
Origin
Unknown
Sources
4 sources carry it
Identifier
GINC-APT-0495 · boolka

What it is

Boolka is a threat actor known for infecting websites with malicious JavaScript scripts for data exfiltration. They have been carrying out opportunistic SQL injection attacks since at least 2022. Boolka has developed a malware delivery platform based on the BeEF framework and has been distributing the BMANAGER trojan. Their activities demonstrate a progression from basic website infections to more sophisticated malware operations.

Tools

The tools and malware families the sources tie to it.

  • Trojan.Karagany
  • Trojan.Mebromi

Sources

  • Malpedia malpedia.caad.fkie.fraunhofer.de