MALWARE FAMILY

BazarBackdoor

Internal ID: win.bazarbackdoor

aliases

Last seen:Mar 17, 2026

Intelligence Profile

BazarBackdoor is a small backdoor, probably by a TrickBot "spin-off" like anchor. Its called team9 backdoor (and the corresponding loader: team9 restart loader).

For now, it exclusively uses Emercoin domains (.bazar), thus the naming. FireEye uses KEGTAP as name for BazarLoader and BEERBOT for BazarBackdoor.

Threat Analysis

BazarBackdoor is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.

External References

→https://abnormalsecurity.com/blog/bazarloader-contact-form

→https://attackiq.com/2022/06/15/attack-graph-emulating-the-conti-ransomware-teams-behaviors/

→https://blog.bushidotoken.net/2022/04/lessons-from-conti-leaks.html

→https://blog.fox-it.com/2020/06/02/in-depth-analysis-of-the-new-team9-malware-family/

→https://blog.google/threat-analysis-group/exposing-initial-access-broker-ties-conti

→https://blog.google/threat-analysis-group/exposing-initial-access-broker-ties-conti/

→https://blog.minerva-labs.com/slamming-the-backdoor-on-bazarloader

→https://blog.prevailion.com/wizard-spider-continues-to-confound-4298370f6903

→https://blog.talosintelligence.com/2021/10/threat-hunting-in-large-datasets-by.html

→https://blogs.vmware.com/networkvirtualization/2020/11/trick-or-threat-ryuk-ransomware-targets-the-health-care-industry.html/

Quick Facts

TypeMalware Family

Aliases1

Also Known As

win.bazarbackdoor

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search BazarBackdoor