Skip to content
brandefense.io
Request A Demo
UnclassifiedUnknown

BazarCall

BazarCall is a threat actor group, tracked by Brandefense. It targets organisations in 5 countries, including the United States and India.

Also known as
  • BazzarCall
  • BazaCall
Request IOC feedRequest ATT&CK export
Techniques
0
Exploited CVEs
No CVE data
First seen
Mar 1, 2021
Record updated

Who They Target.

Countries · 5

Vulnerabilities Linked To Their Tools.

Browse Vulnerability Intelligence →
CVE-2021-44228Apache Log4j2 contains a vulnerability where JNDI features do not protect against attacker-controlled JNDI-related endpoints, allowing for remote code execution.ExploitedcriticalCVE-2024-57726SimpleHelp contains a missing authorization vulnerability that could allow low-privileged technicians to create API keys with excessive permissions.ExploitedcriticalCVE-2024-21887Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure) and Ivanti Policy Secure contain a command injection vulnerability in the web components of these products…ExploitedcriticalCVE-2023-46805Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure) and Ivanti Policy Secure gateways contain an authentication bypass vulnerability in the web component that…ExploitedhighCVE-2024-21893Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure), Ivanti Policy Secure, and Ivanti Neurons contain a server-side request forgery (SSRF) vulnerability in the…ExploitedhighCVE-2024-21412Microsoft Windows Internet Shortcut Files contains an unspecified vulnerability that allows for a security feature bypass.ExploitedhighCVE-2024-57727SimpleHelp remote support software contains multiple path traversal vulnerabilities that allow unauthenticated remote attackers to download arbitrary files from the SimpleHelp…ExploitedhighCVE-2024-57728SimpleHelp contains a path traversal vulnerability that allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted zip file (i.e.Exploitedhigh

Arsenal · Malware And Tools.

  • Bazarmalware
  • CobaltStrikemalware
  • Contimalware
  • Ryukmalware
  • ScreenConnectmalware

About BazarCall.

BazarCall campaigns forgo malicious links or attachments in email messages in favor of phone numbers that recipients are misled into calling. It’s a technique reminiscent of vishing and tech support scams where potential victims are being cold called by the attacker, except in BazarCall’s case, targeted users must dial the number. And when they do, the users are connected with actual humans on the other end of the line, who then provide step-by-step instructions for installing malware into their devices.

Last updated Oct 19, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.