APT / THREAT GROUP

BazarBackdoor

aliases

Last seen:Mar 17, 2026

Intelligence Profile

BazarBackdoor is a small backdoor, probably by a TrickBot "spin-off" like anchor. Its called team9 backdoor (and the corresponding loader: team9 restart loader).

For now, it exclusively uses Emercoin domains (.bazar), thus the naming. FireEye uses KEGTAP as name for BazarLoader and BEERBOT for BazarBackdoor.

Threat Analysis

BazarBackdoor is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://abnormalsecurity.com/blog/bazarloader-contact-form

→https://attackiq.com/2022/06/15/attack-graph-emulating-the-conti-ransomware-teams-behaviors/

→https://blog.bushidotoken.net/2022/04/lessons-from-conti-leaks.html

→https://blog.fox-it.com/2020/06/02/in-depth-analysis-of-the-new-team9-malware-family/

→https://blog.google/threat-analysis-group/exposing-initial-access-broker-ties-conti

Quick Facts

TypeAPT / Threat Group

Aliases7

Also Known As

BazarBackdoorBEERBOTTeam9Backdoorwin.bazarbackdoorbazarloaderKEGTAPbazaloader

External Intelligence

Malpedia: win.bazarbackdoor

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search BazarBackdoor