From c8e623e84ce4cb9a4bdde0c02ce9398db164fcce Mon Sep 17 00:00:00 2001
From: Mathieu4141 <mathieu@feedly.com>
Date: Tue, 18 Jun 2024 04:51:30 -0700
Subject: [PATCH] [threat-actors] Add Bondnet

---
 clusters/threat-actor.json | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index b493b24..93f8fa6 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -16143,6 +16143,18 @@
       },
       "uuid": "0245113e-cef3-4638-9532-3bf235b07d49",
       "value": "TA571"
+    },
+    {
+      "description": "Bondnet is a threat actor that deploys backdoors and cryptocurrency miners. They use high-performance bots as C2 servers and configure reverse RDP environments on compromised systems. Bondnet has infected over 15,000 Windows server machines worldwide, primarily targeting Windows Server 2008 R2 systems. The botnet is used for mining cryptocurrencies like Monero, ByteCoin, RieCoin, and ZCash, potentially earning the operator thousands of dollars per day.",
+      "meta": {
+        "refs": [
+          "https://asec.ahnlab.com/en/66662/",
+          "https://www.akamai.com/blog/security/the-bondnet-army",
+          "https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/"
+        ]
+      },
+      "uuid": "78e8bc1a-0be3-4792-a911-9d4813dd7bc3",
+      "value": "Bondnet"
     }
   ],
   "version": 310