The oldest version of Bisonal we identified was compiled on Dec. The attacker created a Windows library (.dll) designed as a Windows service (ServiceMain() entry point). When executed, the malware uses the Windows API to communicate with the Service Control Manager (SCM) and finally execute a thread. The C2 server of this first Bisonal variant is young03[.]myfw[.]us (port 8888). We can notice the usage of a dynamic DNS service. This is a Bisonal pattern. Even the newest version we identified used this kind of service. In this campaign, the rollback was not used as it is configured to localhost. The communication to the C2 server is performed by using raw sockets: The first action of the malware is to send the hostname of the infected system and the "kris0315" string