New Cyberthreat ‘Boolka’ Deploying BMANAGER Trojan via SQLi Attacks
Websites are being infiltrated by an as-yet-undocumented threat actor known as Boolka, who uses malicious scripts to distribute a modular trojan known as BMANAGER.
In a paper released this week, Group-IB researchers Rustam Mirkasymov and Martijn van den Berk stated that "the threat actor behind this campaign has been carrying out opportunistic SQL injection attacks against websites in various countries since at least 2022."
Threat actors have been inserting malicious JavaScript scripts into susceptible websites for the past three years, with the ability to intercept all data entered on the compromised website.
The JavaScript code that has been added to the website and signals out to a command-and-control server called "boolka[.]tk" each time an unwary visitor comes on the comprom...