Boolka: The evolution of a cybercriminal enterprise

If evolution has taught humanity anything, it’s that adaptation is key to survival. As prey develop camouflage techniques, predators get faster, sturdier, and better at detection. Now this game of cat and mouse is taking over the digital world. 

All cybergangs are on a cycle of relentless adaptation – but a group that stands out from all the rest is Boolka, innovating near-constantly since it first landed on the cybercriminal scene in 2022. Its primary goal is to steal user data across high traffic websites – from usernames, passwords and even credit card information, and sell it for profit on the dark web. 

Group-IB’s Gary Ruddell and Nick Palmer are joined by Joel Fromont, Senior Manager of the EMEA Security Specialists Solutions Architect team at AWS, where they discuss how commercially minded adversaries innovate to stay active and avoid detection, how businesses can effectively respond to such a constantly moving target, and what steps can be taken by users to protect themselves online. 

By understanding who these actors are and how they operate, you can better anticipate threats and protect yourself in an increasingly hostile digital world.

Subscribe to learn more about Group-IB's top 10 Masked Actors  - and stay one step ahead in the fight against cybercrime.

FOLLOW GROUP-IB

• Group-IB Threat Intelligence on X:   https://www.x.com/GroupIB_TI
• Group-IB on X:  https://www.x.com/GroupIB
• Group-IB on LinkedIn:  https://www.linkedin.com/company/group-ib
• Group-IB on Facebook: https://www.facebook.com/groupibHQ/ 
• Group-IB on Instagram: ...

Transcript

Copy Transcript Copied

Gary Ruddell 0:00

If evolution has taught humanity anything, it's that adaptation is key to survival. Over the years, prey creatures have developed brightly colored skins, new odors, and camouflage techniques to keep predators away. And in turn, predators get faster, sturdier, and better at detection. This game of cat and mouse is everywhere in the natural world, and now it's taking over the digital one too. As cybercrime defenses improve, malicious actors are being forced to adapt new ways of attack. They're developing new malware, new attack vectors, and new evasion techniques to try and keep from being caught. In response, IT teams have had to step up their vigilance, pursuing constant security advancements to keep the criminals out. They say adversity breeds innovation. And one group has been innovating near constantly since it first landed in the cyber criminal scene in 2022. And its codename is Bulka. Okay, Nick, what do we know about Bulka and what makes it a notable masked actor group?

Nick Palmer 1:06

Yeah, thanks a lot, Gary. So Bulka really is a cybercriminal group that uh we discovered or first observed really in 2024. Um the group's really been operating since 2022. Um, they're pretty known for using SQL injection, mainly to hack different websites, insert JavaScript, and collect as much information as they can to then profit later. Um, you know, the analysts at Group IB consider BUCA a high-level threat because the group has also built uh different malware families um to remain anonymous, but also um to be creative on the fly. Um the group's ability to really adapt and deploy malware uh is significant um in this nature.

Gary Ruddell 1:53

And what's their aim? Like what do they want to do with this personal data?

Nick Palmer 1:57

Yeah, so Vulca really wants to uh compromise as much data as possible. They want to um compromise high traffic websites, um, get uh as much personal information or financial information as they can so they can profit. So they really have a high impact on thousands of different businesses that they can target. And this really puts any business with an insecure website at risk. Um, anything that can be targeted by an SQL injection is at risk to this particular threat actor.

Gary Ruddell 2:30

Thanks, Nick. Well, we're lucky enough to be joined today by Joel Fromont, who is the senior manager of the AMEA Security Specialist Solutions Architect team at Amazon Web Services. Thanks for sitting down with us, Joel. Can you tell us a little bit about yourself?

SPEAKER_00 2:45

Yeah, sure. Uh thank you for having me. Uh I have two decades of experience in IT and security. Prior to joining AWS in 2022, I worked for two global heavy industry companies, uh, LaForge, a manufacturing cement, and Imeris, a mining company. I've led uh several complex technical projects for users across up to 90 countries, including networking, collaboration, security, identity and access management, email security, firewalls, uh, security operations center. I ended up becoming a CISO among other rules. Um I've been on the front lines of incident response for a ransomware attack, which has given me some valuable lessons. Um, this is the very moment when you benefit from all that you've prepared and you suffer from your gaps. Um compromise sites, have you build a strong partnership with your security suppliers for them to help you during and after the crisis? Is your team mobilized for the crisis? First, uh your business needs to survive, then you want to understand the attack, then you restore the services, and then you launch a security improvement plan with a strong support from the top management. Uh my work has led me to develop a keen interest in when groups evolve tactics and how we can respond to keep ahead of threats.

Gary Ruddell 4:27

Awesome. Thanks, Joel. You've had a pretty interesting career by the sounds of it. I think you're the first person I've met that's actually dealt with an actual ransomware attack. Um, Bulka are known for modular malware. Can you talk us through what that is and why it's so dangerous?

SPEAKER_00 4:43

Sure. Modular malware is significantly harder to detect than conventional malware. Uh, the initial payload is often minimal and appears benign, uh, allowing to bypass security defenses. Only after establishing itself does it download additional malicious components which may be encrypted or obfuscated. Uh the malware can assess the victim's system and selectively deploy only the modules that will be effective against that specific environment. So it's kind of polymorphic. For example, it might deploy different modules based on what security software is installed, making each attack customized and more difficult to defend against. Depending on what the attacker wants to steal, they can pick and choose the module so that they scrape the right kind of information from an infected website. So, for example, they can use a keylogger module to steal passwords, a file theft module to get the files, or use a JavaScript injection to take all the user inputs.

Gary Ruddell 6:01

And what's the benefit for them for doing it this way?

SPEAKER_00 6:06

Well, uh modular malware gives cybercriminals better success rate, lower cost, higher profits, and reduced risk of detection and prosecution, making it an extremely attractive approach to their perspective. Cybercriminality is business. Modularity leads to a better return on investment.

Nick Palmer 6:29

Yeah, definitely. And another real benefit of that, like you said, is the group's ability to use this module malware and really switch out any of the modules that they need without having to write their malware. And, you know, this means that they can adjust what they're doing quickly, get back to stealing data uh without any interruptions, right? And that's what Bulka's been doing for a long time. And that's one of the reasons that they've been under the radar for so long.

Gary Ruddell 6:55

Yeah, this adaptable malware seems to mirror their overall tactics, doesn't it? You know, adapt, change, evolve.

Nick Palmer 7:02

Yeah, you only have to look at the timeline of Bulka's attacks to see the pace of change. Really, in in 2022, when the group started, it was mostly simple SQL attacks. But by 2024, it had launched really a full platform with different module malware and capabilities. The scripts are more dynamic, and the group has in introduced different stealth features along the way to help them avoid detections.

Gary Ruddell 7:25

Now we know to an extent that all groups try to achieve this kind of evolution. What is it that makes Bulka such a strong example in this, Nick?

Nick Palmer 7:34

For me, I like to look at cybercriminal groups as uh how closely are they operating to a scalable, profitable business model? And really that's what Bulka is doing. They're developing and building their own malware. And it proves that these threat actors are not just opportunistic, they're building a business, if you will, and they're committed to developing their tools, their trade cap, their tradecraft, and making it more scalable and a more mature group overall.

SPEAKER_00 8:03

And it also shows us that the group is really planning ahead. Malware development requires sustained effort, which they're putting in place. Nicholas makes an excellent point about Bulka's rapid evolution. What makes Bulka particularly noteworthy as an example is the speed and the sophistication of their progression. It's really the strategic mindset coupled uh with the skill growth that suggests a more disciplined and persistent threat.

Gary Ruddell 8:38

And Joel, how do we see the strategic use of modular malware changing the, I guess, the economics of cybercrime?

SPEAKER_00 8:47

Yeah, it's it's really about economics. Uh cybercrime now costs the global economy an estimated uh uh 10 trillion annually, which is uh which could be 20 times larger than the illegal drug trade, which is estimated at 500 billion. This scales means cyber criminals have really unlimited resources to recruit skilled developers, build sophisticated infrastructure, and sustain long-term operation. We're also seeing increased activity from state-sponsored threat actors who bring nation-state resources and strategic objectives to the threat landscape. The economics have fundamentally shifted. Historically, building sophisticated malware required significant upfront investment, skilled developers, time and infrastructure. Being modular makes uh that this kind of malware has disrupted this model entirely. You now have a kind of malware as a platform, or uh on the model of the software, the service dynamic, where the core investment is made once, and then individual modules can be developed, tested, and deployed both rapidly and cheaply. So, what we see is that cyber criminals have adopted agile development methodologies. Criminals are building and deploying unique malware at a much faster rate. It also brings to light the willingness of cyber criminals to refine their methods once security teams have caught on their tactics. The days of uh fingerprinting ones, protected forever, this is over. Uh, traditional signature-based defenses that identify and block non-threats are no longer sufficient. Threat actors evolve too quickly for static defenses to remain effective. Uh, at AWS, for example, we use uh MatPod and Mithra. Uh MatPOT is a network of tens of thousands of sensors detecting up to uh 100 million attacks daily. And in parallel, we have Mithra, which is really uh leveraging DNS and all the information we get from uh billions of DNS information every day in a neural network mode. And this helps us identify rogue actors. And then we use the data and the findings collected from MatPOT and Mitra to feed our security services such as GoDuty and Security Hub. And and one of the learnings uh that MatPOT revealed is that rogue IP addresses lifecycle is around three minutes. That's how fast uh rogue IP addresses rotate. This puts into perspective how security teams must now continually adapt and respond to the cybercritical agility.

Nick Palmer 12:14

Yeah, I can see the analysts at Group IB uh licking their chops to get access to that wonderful telemetry that you mentioned, Joel. And I think you have a lot of great points about the cyber criminal ecosystem and really the rapid development that's taking place. You know, first you have to look at how cyber criminals are designing their businesses, quote unquote, to scale, you know, what different uh capabilities they're doing uh to increase their efficiency and maximize their return on investment. And, you know, the second thing that we see in the cyber criminal uh ecosystem is, you know, cyber criminals are starting to take advantage of AI like the rest of the world as well. They're designing more convincing phishing emails, they're using deep fake technologies, generating images. You know, they no longer have mistakes in their uh campaigns to people, right? We've also seen them starting to leverage AI and their code development as well to speed up uh deployment of new capabilities. Uh, we actually have a really great report that the Group IB intelligence analyst did. It's called Weaponized AI. Um, and that covers kind of what cyber criminals are implementing from an artificial intelligence perspective and what they're using in those different tools and tradecraft as well.

SPEAKER_00 13:30

Well, it's it's a race, uh, as we said at the very beginning, uh, between attackers and defenders. Um however, I believe that a strong foundations and a multi-layered security approach is the best posture to resist attack. We're looking at BULCA today, but at the end of the day, what a defender needs to put in place needs to resist all kinds of attacks, including uh BULCA. So if you reduce your surface of attack with uh perimeter protection, such as well-configured firewalls, opening only the port you actually need, not overexposing to the internet, having anti-DDoS uh in place. At AWS, uh our customers use SHILD and WAV, they use CloudFront. Uh, you need good identity management as well. Uh, this way you reduce the likelihood to be attacked even by well-equipped attackers. And and back to uh securing agentic AI, it's definitely a subject in itself. And uh I believe that one of the first requirements of agentique AI security is that the rest, what we could uh call legacy security, is in place. Because if you build on top of uh weak foundations, uh your angenic AI security is doomed. Um well, but on top of legacy security, you need to make sure that your agents are secured as well. For example, you need to look at agents' identity and access management, and that's a new topic. What kind of uh uh access rights do you grant to agent? How long for? And that's that's super important.

Gary Ruddell 15:31

Yeah, definitely this ecosystem is changing really fast. Joel, how can businesses get the balance right between usability, openness, and some abuse prevention?

SPEAKER_00 15:44

Uh as I just said, everyone needs uh today more than ever to do their homework. We say eat your security vegetables with uh the strong multi-layer defense that uh I just mentioned. No layer is going to be perfect, though. So the idea is that even if an attack goes through one of the layers, there will be another layer uh providing protection. And and the good way to get organized for this is uh to make sure that you cover all chapters of security. Uh like it is well described in in the norms, such as uh ISO 2701, NIST2 in Europe, NIST. Uh well, and then it covers all the chapters like identity and access management, which is a key part of the zero trust philosophy, governance, super important, secure development, perimeter protection, incident detection and response, patching, email security. You need to make sure you can uh tick all the boxes.

Nick Palmer 16:54

Yeah, I think those are are really great points, Joel. You know, having a good, secure foundation in place, multi-layered approach. And, you know, once you have that in place, it's I I always think it's important to understand who are my adversaries and how could they target me and what tools and techniques would they use to do so. You know, that's one of the most important things, I think, after you have all of the foundational elements in place for security, so that you can be prepared for these adversaries that may target your business and what tools and techniques these adversaries may use to do so. Um, you know, if we take that approach to BULCA, um, you know, obviously regularly patching uh to prevent SQL injections on your site, that's the weak entry point for them. You know, you maybe want to consider doing different offensive security audits or vulnerability assessments to fix additional potential weakness points. Um, you definitely want to be monitoring for web traffic, for unusual script injections into your page and looking for things like Beamanager, their customized malware tool. Um, you know, if you understand those uh tools and techniques, these are the things you need to be on the hunt for.

SPEAKER_00 18:02

I I think it's uh it's a trade-off between uh I want to be ready and defend against all kinds of bad actors, uh, including the ones like uh Bulka. Uh but also at the same time, the question is uh why should I be a target? Is it my reputation? Is it the data uh that I have? Is it uh money? What is the what is the motivation of the bad actors? And once we've understood the risk level, um I would insist on the need to have a strong sponsorship from the top management up to comex level, CEO level, and and board level. That is super important.

Gary Ruddell 18:54

Yeah, I love that. We often hear this from our guests. Uh where do you see opportunity for collaboration within an ecosystem like this?

SPEAKER_00 19:03

Well, security is a business problem at the end of the day, because uh if anything bad happens, the business is impacted. So you need everyone internally to be on the same page for robust defense, involving key stakeholders uh in security decision and response plans is critical. For example, at AWS, our CEO attends a weekly call with the security team, the CISO, and anyone who needs to be involved because they are at risk or because an incident has occurred. It's the kind of integrated thinking that helps us to put us on the front foot of attacks. Um, in many companies, uh, teaming with the audit department is a good idea because uh the role of the audit department is to assess and report on the risk that the company is taking. And it's a common mistake that IT uh bears the cyber security risk. It shouldn't be IT, it should be the audit department. And uh so the the best solution is really to partner between IT and the audit departments. And um additionally, uh threat intelligence uh needs to be used. We've not mentioned it a lot so far, but uh if you know uh what's on the dark net, uh what kind of threat you're exposed to, it's better to uh defend oneself. And it's like for war, intelligence is key. This can be achieved either through partners or when using a large cloud provider. It's about constant vigilance, there's definitely no one-time fix.

Gary Ruddell 20:59

Yeah, and I mean boker's attacks obviously impact the businesses that they target, but also you got these users, end users, and you know, normal people who get caught up in it. Uh, what do the defenders and the users you know misunderstand about trusted services?

SPEAKER_00 21:18

There's a common misconception that popular or well-established sites can't be vulnerable to attacks. Uh, in practice, SQL injection vulnerabilities can be found anywhere implementation is flawed. And if you look at some sites that report on breaches, uh, you'd be surprised to see that every day you have well established companies or uh administration that get uh breached in.

Gary Ruddell 21:54

And how can people stay safe online then when it's sort of impossible to know where? Which websites are actually secure.

Nick Palmer 22:02

Yeah, I think if we're we're talking about the layman, right? The you know, my mother for for example, um, or or really anybody for that matter, the the main advice from me is to be suspicious, um, you know, to to ask questions. And I think it's having this mindset that that can make all the difference, you know, little things like taking into consideration the email or suspicious email you receive that may be putting pressure on you to uh send communications out or um send information about your your bank. Uh take a quick look, look at who's actually sending that email. Is it from someone you recognize? Should I maybe go to um uh go to the actual legitimate website to uh call them directly and see if it's actually something that they want me to do, right? Um, so I think those are are different things that you can do. Um, be suspicious. There's also other things, right? Like turning on multi-factor authentication on all of your different services, your email services, um, your social media services as well. Uh, definitely only downloading apps from official app stores or trusted official sources that you can verify. Um, you know, these these things can help you keep safe, I think, for the laymans.

SPEAKER_00 23:24

Um yeah, education plays a key role, and uh users need to adopt a defensive outlook, almost paranoid. I think uh everyone should be paranoid in such a context, in the good sense of the word. And uh yes, following uh Nick's advice to ensure any attack that does impact them doesn't uh have far-reaching, undesired implications. But while users need to be proactive about online security, when sites have vulnerability, it's not the user's responsibility to mitigate them. Uh for defenders, it's a case of keeping developing and keeping collaborating. If cyber criminals aren't keeping the status quo and they aren't, we can't afford to be complacent.

Gary Ruddell 24:22

Awesome. Well, Joel, thank you very much for taking the time to join us today to talk about all things bulgar and cyber attacks. Uh, we look forward to catching you again soon.

Nick Palmer 24:34

Thanks a lot, Joel.

Gary Ruddell 24:35

Thank you. Your data is valuable and it's under attack. Cyber espionage groups, financially motivated threat actors, ransomware attackers, and other criminal enterprises are on the rise. Working in secrecy to dismantle security perimeters, they spread like a virus through the web, stoking geopolitical tensions, holding businesses to ransom, and flooding criminal marketplaces with sensitive information. These groups thrive in secrecy now more than ever. Knowing who your adversaries are is critical. So join us as we ask who's behind the world's most prolific cyber criminal groups? What are their tactics, their motivations, and their impact? Who are the world's masked actors? Masked Actors is an independent podcast from Group IB, a leading voice in the fight against cybercrime. The threat landscape evolves quickly, but all information was correct at the time of recording and based on Group IB's high-tech crime trends report 2025. Join in the conversation online using the hashtag masked actors. And don't forget to subscribe so you don't miss an episode. Thanks for listening. See you next time as we uncover more of the world's top masked actors.