BazarLoader
Initial-access loader (Wizard Spider)
Source Attribution
- Origin
- MITRE
- Source
- Mandiant reports
- Verified
- 2026-08-26T16:07:01.550Z
- Confidence
- high
Source: Mandiant reports · Verified: 2026-08-26T16:07:01.550Z · Confidence: high
Security Timeline
- discovered BazarLoader first observed
- updated Encyclopedia entry reviewed (Phase 45C)
Quick Answer
BazarLoader is a loader linked to Wizard Spider that delivered Cobalt Strike and ransomware. (attributes recorded from Mandiant reports).
Definition
BazarLoader is a loader linked to Wizard Spider that delivered Cobalt Strike and ransomware.
Overview
BazarLoader is a loader linked to Wizard Spider that delivered Cobalt Strike and ransomware.
Behavior
- BazarCall phone-assisted phishing
- loads Cobalt Strike
First Seen
2019-08
Target
Initial-access loader (Wizard Spider)
Malware Intelligence
Family: BazarLoader
Techniques: T1566, T1105
Targets: Initial-access loader (Wizard Spider)
Behavior:
- BazarCall phone-assisted phishing
- loads Cobalt Strike
References
Have a follow-up question?
Ask AI about this Start an investigation Ask OpenTrojan's evidence-backed assistant about this topic — answers cite their sources.