BlueBottle
BlueBottle is a threat actor group, tracked by Brandefense. It targets the Finance sector. It uses 6 MITRE ATT&CK techniques.
- Techniques
- 6
- Exploited CVEs
- No CVE data
- First seen
- May 1, 2022
- Last seen
- Sep 1, 2022
- Record updated
Who They Target.
How They Operate · MITRE ATT&CK.
6 techniques across 4 of 14 tacticsVulnerabilities Linked To Their Tools.
Browse Vulnerability Intelligence →Arsenal · Malware And Tools.
- GuLoadermalware
- NETWIREmalware
- POORTRYmalware
- QuasarRATmalware
- BloodHoundtool
- Cobalt Striketool
- Mimikatztool
- ngroktool
- PsExectool
- rdpwraptool
Indicators Of Compromise.
TLP:CLEAR- Hash
91b3546dde60776ae3ed84fdf4f6b5fba7d39620f0a6307280265cde3a33206b - Hash
ce2ea1807d984e1392599d05f7ab742bae4f20f8ef80c5a514fbdeede2ff7e55
13 more indicators on the Brandefense platform
IP, domain and hash indicators · YARA rules · ATT&CK Navigator export
Request A DemoAbout BlueBottle.
The activity ran from at least July to September 2022 and possibly began in May 2022. The intruders relied on commodity and dual-use tooling rather than custom malware: GuLoader and.NET downloaders pulling payloads from transfer.sh, NetWire and Quasar RATs, Cobalt Strike, a fake logon screen and Revealer keylogger for credentials, Mimikatz, SharpHound, PsExec, Ngrok and RDPWrap, and a signed kernel driver (POORTRY family) used to kill security products.
They also enabled WDigest credential caching, added accounts to local groups and opened RDP.
Last updated Nov 10, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.