Tonto_Team__2020__CactusPete_APT_group_s_updated_Bisonal_backdoor_Securelist.pdf

This report analyzes the CactusPete APT group and its updated Bisonal backdoor, describing spear-phishing distribution, RC4-based C2 communication, and a suite of post-compromise capabilities. It notes historical campaigns from 2018–2020 targeting financial and military entities in Eastern Europe and Asia, and provides IoCs and known payload names to assist detection, attribution, and defense.