In the Balkans, businesses are under fire from a double‑barreled weapon

ESET researchers discovered a campaign that uses two malicious tools with similar capabilities to ensure both resilience and broader potential for the attackers

ESET researchers discovered a campaign that uses two malicious tools with similar capabilities to ensure both resilience and broader potential for the attackers

We’ve discovered an ongoing campaign in the Balkans spreading two tools having a similar purpose: a backdoor and a remote access trojan we named, respectively, BalkanDoor and BalkanRAT.

BalkanRAT enables the attacker to control the compromised computer remotely via a graphical interface, i.e., manually; BalkanDoor enables them to control the compromised computer remotely via a command line, i.e., possibly en masse. ESET security products detect these threats as Win{32,64}/BalkanRAT and Win32/BalkanDoor.

A typical victim of this campaign, which uses malicious emails as its spreading mechanism, ends up having both these tools deployed on the computer, each of them capable of fully controlling the affected machine. This rather uncommon setup makes it possible for attackers to choose the most suitable method to instruct the computer to perform operations of their choice.

The campaign’s overarching theme is taxes. With the contents of the emails, included links and decoy PDFs all involving taxes, the attackers are apparently targeting the financial departments of organizations in the Balkans region. Thus, although backdoors and other tools for remote access are often used for espionage, we believe that this particular campaign is financially motivated.

The campaign has been active at least from January 2016 to the time of writing (the most recent detections in our telemetry are from July 2019). Some parts of the campaign were briefly described by a Serbian security provider in 2016 and the Croatian CERT in 2017. Each of these sources focused only on one of the two tools and only on a single country. However, our research shows that there is a significant overlap in targets and also in the attackers’ tactics, techniques and procedures.

Our findings show that the mentioned attacks have been orchestrated and we consider them a single long-term campaign that spans Croatia, Serbia, Montenegro, and Bosnia and Herzegovina.

Our research has also shed more light at the malware used in this campaign and provided some context. We’ve discovered a new version of BalkanDoor with a new method for execution/installation: an exploit of the WinRAR ACE vulnerability (CVE-2018-20250). Furthermore, we’ve seen both malicious tools digitally signed with various certificates the developers paid for to add perceived legitimacy. One of them, issued to SLOW BEER LTD, was even valid at the time of writing; we’ve notified the issuer about the misuse and they revoked the certificate.

In this article, we will describe some notable features of both BalkanDoor and BalkanRAT. Our analysis shows that the former runs as a Windows service, which allows it to unlock the Windows logon screen remotely and without the password or start a process with the highest possible privileges. The latter misuses a legitimate remote desktop software (RDS) product and uses extra tools and scripts to hide its presence from the victim, such as hiding the window, tray icon, process and so on.

Targets and distribution

Both BalkanRAT and BalkanDoor have been spread in Croatia, Serbia, Montenegro, and Bosnia and Herzegovina. (These countries, along with Slovenia and former Macedonia, formed the country of Yugoslavia until 1992.)

Figure 1. Malware distribution by country

According to our telemetry: the campaign spreading these tools has been live since 2016, with the most recent detections as late as in July 2019.

The attackers have been distributing their tools via malicious emails (“malspam”) with links leading to a malicious file.

The links included in the malspam emails used for distribution of both BalkanRAT and BalkanDoor mimic legitimate websites of official institutions.

Table 1. Domains misused in the campaign
Malicious domainReal domainInstitution
pksrs[.]compks.rsChamber of Commerce and Industry of Serbia
porezna-uprava[.]comporezna-uprava.hrMinistry of Finance of Croatia, Tax Administration
pufbih[.]compufbih.baTax Administration of the Federation of Bosnia and Herzegovina

The decoy PDFs revolve around the tax theme.

Table 2. Decoy PDFs used in the campaign
PDF nameLanguageContent
MIP1023.pdfBosnianTax form
Ponovljeni-Stav.pdfBosnianTax law
AUG_1031.pdfBosnianInstructions for using tax filing application
Zakon.pdfCroatianTax law
ZPDG.pdfSerbianTax law

Figure 2. Decoy PDF documents

Most often, the links leading to an executable file are disguised as links to a PDF. The executable file is a WinRAR self-extractor with its name and icon changed to resemble a PDF to fool the user. When executed, it is configured to unpack its content, open the decoy PDF to prevent any suspicion – and silently execute either BalkanRAT or BalkanDoor.

In some of the latest samples of BalkanDoor detected in 2019, the malware is distributed as an ACE archive, disguised as a RAR archive (i.e., not an executable file), specially crafted to exploit the WinRAR ACE vulnerability (CVE-2018-20250). This vulnerability, which has been remediated in version 5.70 released on February 28th, 2019, is known to have been exploited quite often to distribute malware.

The exploit-based deployment of BalkanDoor is stealthier than in previous versions of the malware because it does not require executing the downloaded file – an operation that might raise the intended victim’s suspicions.

The campaign

According to our telemetry, most of the time, both tools have been deployed on the same machine. The combination of the tools gives the attacker both a command-line interface and a graphical interface to the compromised computer.

In the case of the whole toolset being deployed on the machine, here is an example scenario for the attack:

The attacker detects that the victim has the screen locked and thus, most probably, is not using the computer (either via BalkanDoor sending a screenshot showing that computer is locked, or via the View Only mode of BalkanRAT). Via the BalkanDoor backdoor, the attacker sends a backdoor command to unlock the screen… and using BalkanRAT, they can do whatever they want on the computer.

However, even if the victim does not use the computer, the chance of spotting the actions performed by the attackers is still there. Even with this disadvantage, using the RDS tool may be useful. The attackers are not limited by the commands shipped in the backdoor, or by their programming skills: manually, they can perform actions that would require writing a lot of code if a backdoor were the only tool available.

In principle, the Balkan- toolset could be used for espionage, among other possible goals. However, not only the campaign’s targets and distribution, but also our analysis of the Balkan-toolset tools show that the attackers are going after money instead of espionage.

The BalkanDoor backdoor does not implement any exfiltration channel. Presumably, if the campaign were intended for espionage, the attackers would need an exfiltration channel for uploading the collected data – at least as a backup to manual exfiltration, which might not be always an option.

On the contrary – and supporting the notion that the attackers’ goal has been to commit some financial crime – we’ve seen BalkanRAT dropping a tool that can list available smart cards, via the SCardListReadersA/ SCardConnectA API functions. Smart cards are usually issued by banks or governments for confirmation of the holder’s identity. If misused, smart cards can facilitate illegal/fraudulent activities, e.g. digitally signing a contract, validating a money transaction etc.

In the past, we’ve seen this feature in Operation Buhtrap, a campaign targeting Russian banks.

Analysis – BalkanDoor

BalkanDoor is a simple backdoor with a small number of commands (download and execute a file, create a remote shell, take a screenshot). It can be used to automate tasks on the compromised computer or to automatically control several affected computers at once. We have seen six versions of the backdoor, with a range of supported commands, evolve since 2016.

The initial dropper unpacks all its components, opens a decoy PDF (in some cases) and executes a batch installation script that ensures persistence of the backdoor.

The backdoor registers itself as a service, under a legitimately-looking service name (e.g. WindowsSvc, WindowsPrnt, WindowsConn or WindowsErr); the accompanying batch scripts can further ensure persistence by using Registry Run Keys or Startup folder.

After the backdoor is installed, the computer connects to a C&C server, identifying itself by the computer name and requesting commands. The backdoor can connect to any of the C&Cs from a hardcoded list – a measure to increase resilience. It connects via the HTTP or HTTPS protocol; if HTTPS is used, then the server certificates are ignored.

If the connection is not successful, the backdoor is capable of using the user-configured proxy on the victim’s computer and repeating the connection attempt.

The backdoor commands come in a format of an INI file, with properties determining the commands, command arguments and intended recipients. Specifying the list of recipients allows the attacker to send their commands to several compromised computers at once, e.g. to take screenshots of all compromised computers automatically.

Table 3. BalkanDoor’s commands
cnSpecifies computer name(s) of the intended recipients of the commands
du, intDownload and execute a file
du, ra, de, rpoDownload and execute a file, in the specified context and on a specified desktop
ripCreate a remote shell accessible from the specified IP address
scr_int, scr_durCapture a series of screenshots of the specified duration

Furthermore, the backdoor itself can be executed in several modes, determined by the command line arguments with which it is executed. These modes themselves can serve as backdoor commands (when executed from the remote shell):

Table 4. BalkanDoor’s modes
/unlockUnlocks the screen
/rcmdCreates a remote shell and redirects its input/output to the specified IP address
/takescrCaptures a series of screenshots, duration determined by other arguments
/runExecutes the specified command using cmd.exe
/runxExecutes the specified command using cmd.exe, on the active (input) desktop
/instInstalls itself as a service and starts the main procedure (see /nosvc)
/startStarts the associated service, which starts the main procedure (see /nosvc)
/nosvcMain payload, communicates with C&C and interprets backdoor commands

Among the BalkanDoor capabilities, the most notable is passwordless screen-unlocking.

This feature comes in handy to the attackers in cases when a logged-in user locks the computer. The “Lock screen” is just another Desktop for the system, so any malware with the necessary privileges can switch to a real desktop by command. No password is required to perform this operation.

Figure 3. Code responsible for unlocking the computer when the backdoor is executed remotely with a “/unlock” argument

Analysis – BalkanRAT

The BalkanRAT part of the malicious Balkan- toolset is more complex compared to its backdoor accomplice. Its goal is to deploy a copy of the Remote Utilities software, which is commercial software by a Russian vendor, Remote Utilities, LLC, used for remote access to a computer or for remote administration. BalkanRAT also provides the attacker with the credentials needed for this remote access.

BalkanRAT has several additional components to help load, install and conceal the existence of the RDS. They can add exceptions to the firewall, hide the RDS’s window and its tray icon, and hide the presence of related processes in the task manager.

Figure 4. Components used in the campaign to deploy and hide the presence of the RDS

  1. The dropper first unpacks all components; a configuration file, the remote desktop software and a core component installing it, a userland rootkit, a GUI hider and a decoy PDF file.
  2. The dropper opens the PDF file so as not to arouse suspicion of the user.
  3. Covertly, the dropper executes the core component (32-bit) in the installation mode.
  4. The core component (32-bit) installs itself to be executed with each start, and adds an exception to the firewall for the RDS. It executes commands inst1 and inst2 specified in the configuration file, and executes itself again, now in stealth mode.
  5. In this mode, the core component acts like a keylogger.
  6. The core component (32-bit) executes the 64-bit version of itself, in injection mode (if applicable).
  7. The core component (64-bit) injects the userland rootkit (64-bit) into task manager processes. The userland rootkit then hides the presence of the malicious processes in the task manager.
  8. The core component (32-bit) executes the RDS. It repeatedly monitors and hides the RDS window (because it is a GUI application).
  9. The core component (32-bit) injects the userland rootkit (32-bit) into task manager processes. The userland rootkit then hides the presence of the malicious processes in the task manager.
  10. The core component (32-bit) executes commands cmd1 and cmd2, as specified in the configuration file. One such command was seen executing a GUI hider, which is an AutoHotKey script hiding the tray icon of the RDS.

Note: Some components are optional. Also, sometimes they are deployed as a set comprising an encrypted payload and the corresponding loader. We are omitting these details.

The configuration file of BalkanRAT is in INI file format (similarly to BalkanDoor, which uses this format for backdoor commands), with one section named [CFG]. The INI file is used by the malware’ core component and the userland rootkit.

inst1, inst2Commands executed by the core component during installation
cmd1, cmd2Command executed by the core component main payload
hprocList of processes that should be hidden by userland rootkit
mprocList of processes where userland rootkit is injected

Figure 5. BalkanRAT’s configuration file – properties (top) and example (below)

BalkanRAT’s core is a multipurpose component (there are both 32-bit and 64-bit versions); it can be executed in various modes, determined by the command-line argument. Most significantly, it is used for installation of BalkanRAT, launching a userland rootkit and adding exceptions for the RDS component in the firewall.

Table 5. BalkanRAT’s core component – supported functionality
/rhcExecutes a batch file
/fwlAdds exception to the firewall for the specified program
/sregSets configuration data for the RDS in the registry (especially email address where the credentials should be sent)
/instEnsures persistence by adding itself to the [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] registry key under the “load” entry. Adds exception for the RDS to the local firewall. Executes itself again in the main mode (no arguments).
/injInjects the userland rootkit library into processes, as specified in the configuration file
(none)Main mode. Executes the 64-bit version of itself (if applicable), injects the userland rootkit, executes the RDS and hides the window by changing its coordinates to values outside the screen.
Another thread captures pressed keystrokes.

The main part of the BalkanRAT malware is a copy of the Remote Utilities software for remote access. Instead of using the official version, BalkanRAT deploys a copy signed by a certificate of the attacker.

The client side of the RDS running on the victim’s computer must know the unique ID and the password, both generated on the server side, to connect to the server. The RDS deployed by BalkanRAT is configured in such a way that the password is the same for all victims, and the generated unique ID is sent to the attacker’s email address by the tool itself.

Since the tool BalkanRAT misuses is legitimate, it leverages the genuine Remote Utilities’ infrastructure for this communication (,; due to this, the communication may seem legitimate to the user – and to security products.

As a result, the attacker has obtained credentials to access the compromised computer via the Remote Utilities software. Using this tool, they can broadcast the screen to monitor the activity of the user and manually take over the compromised computer.

Figure 6. A window the victim never sees. With a legitimate copy of Remote Utilities, this window is visible; however, BalkanRAT will hide it using the GUI hider feature.

To remain stealthy, BalkanRAT uses the GUI hider feature. In most samples (some older ones are exceptions), it is implemented as an AutoHotKey script, compiled into an executable file so that it can be run on a computer even if AutoHotKey is not installed there. The purpose of this script is to hide the tray icon of the RDS client.

Figure 7. AutoHotKey script embedded in the resource section of the executable

Another notable feature used by BalkanRAT to stay hidden is the ability to hide processes from the user.

To achieve this, userland rootkit libraries are injected in processes hardcoded in the configuration file. The userland rootkit hooks the NtQuerySystemInformation function for the process in which it is injected. In case SystemProcessInformation is queried, it filters out all entries for processes with the names specified in the configuration file. As a result, conventional task manager utilities will not display the processes the attackers want to keep hidden from the user.

Figure 8. With the userland rootkit injected, some processes are missing in the list (left). Without the rootkit, the processes are visible (right).

Naturally, the list of processes that will be hidden contain mostly ones belonging to BalkanRAT. However, we have also seen names like “weather.exe” or “preserve.exe” in the list – which belong to the BalkanDoor backdoor. This finding supports the belief these two tools are indeed used together.


Both BalkanRAT and BalkanDoor have some interesting tricks up their sleeves and each of them separately pose a significant risk to the victims. If used together as a toolset, they make an even more powerful weapon – the campaign we have discovered targets accounting, a function that is critical for organizations.

The campaign targeting accountants in the Balkans shows some similarities (in terms of modus operandi) with a campaign aimed at Ukrainian notaries reported in 2016. (The only source we have been able to find describing it is in Russian.) In that case, the attackers’ goal was to take control over a notary’s computer and issue some illegal operation on behalf of the notary.

Just as attackers may confirm a fraudulent transaction on behalf of a notary, they may perform a fraudulent transaction while impersonating a manager in a company’s financial department.

To stay safe, business users – and their employers – should follow basic cybersecurity rules: be cautious about emails and scrutinize their attachments and links, keep their software updated and use a reputable security solution.

Indicators of Compromise (IoCs)

ESET detection names



BalkanDoor – executable files


BalkanRAT – executable and auxiliary files


Remote Utilities (otherwise legitimate releases signed by attackers’ certificates)




Configuration files


Decoy PDF files


Misused certificates

NameEmailValid fromValid toSHA1 ThumbprintStatus at the time of writing
AMO-K Limited Liability Companyllc.amo-k@list.ru2015/07/302016/07/284E36C4D10F1E3D820058E4D451C4A7B77856BDB3Expired
Valmpak, TOVtov-valpak@mail.ru2016/04/102017/04/0117D50E2DBBAF5F8F60BFFE1B90F4DD52FDB44A09Revoked
Valmpak, TOV-2016/08/222017/11/044A362020F1AFD3BD0C67F12F55A5754D2E70338CRevoked
3D PEOPLE LIMITED-2017/11/052018/11/06936EDFB338D458FBACB25FE557F26AA3E101506EExpired
ADUNIK LTD-2017/10/112018/10/12E7DF448539D1E2671DCF787CF368AAC2ED8F5698Expired
SLOW BEER LTDadministrator@

File names


Dropper: Zakon.exe
Backdoors: weather.exe, winmihc.exe, Preserve.exe, PreservS.exe, WindowsConnect.exe
Scripts: weather.cmd, winmihc4.cmd, mihcupdate.cmd
Decoy PDF file: Zakon.pdf


Droppers: ZPDGI.exe, ZPDGV.exe, ZPDGE.exe, ZPDGO.exe, ZPDGU.exe, ZPDGA.exe, Ponovljeni-Stav.exe, AUG_1031.exe, MIP1023.exe
Configuration file: stg.cfg
Decoy PDF files: ZPDG.pdf, Ponovljeni-Stav.pdf, AUG_1031.pdf, MIP1023.pdf
Core component: winchk32.exe, wininit.exe, hide.exe, winchk64.exe
RDS: rutserv.exe, rfusclient.exe
Userland rootkit: winmmon.dll, winmmon64.dll
GUI hider components: serk.bat, serk.exe

Folder names


C&C servers


Email addresses used to exfiltrate Remote Utilities credentials

MITRE ATT&CK techniques


Initial AccessT1192Spearphishing LinkBalkanRAT is distributed via emails that contain links to malware.
ExecutionT1059Command-Line InterfaceBalkanRAT uses cmd.exe to execute files.
T1106Execution through APIBalkanRAT uses ShellExecuteExW and LoadLibrary APIs to execute other malware components.
T1064ScriptingBalkanRAT uses batch scripts for malware installation and execution.
T1204User ExecutionBalkanRAT relies on the victim to execute the initial infiltration. The malware is disguised as PDF documents with misleading names, in order to entice the intended victim to click on it.
PersistenceT1060Registry Run Keys / Startup FolderBalkanRAT uses the following Registry Run key to establish persistence: [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows], “load”.
Privilege EscalationT1134Access Token ManipulationBalkanRAT is able to impersonate the logged-on user using DuplicateTokenEx or ImpersonateLoggedOnUser APIs.
Defense EvasionT1116Code SigningBalkanRAT is digitally signed with code-signing certificates.
T1140Deobfuscate/Decode Files or InformationBalkanRAT decrypts and decompresses some of its components.
T1089Disabling Security ToolsBalkanRAT is capable of adding exceptions to the local firewall, using its COM interface.
T1112Modify RegistryBalkanRAT modifies the [HKEY_CURRENT_USER\Software\Usoris\Remote Utilities\Server\Parameters] registry key to store configuration of the RDS
T1027Obfuscated Files or InformationSome components of BalkanRAT are compressed and then encrypted by a XOR cipher.
T1055Process InjectionBalkanRAT injects a userland rootkit library into processes of task manager utilities.
T1108Redundant AccessOperators of BalkanRAT have been seen deploying a second malicious tool (BalkanDoor) to preserve remote access in case BalkanRAT is removed.
T1014RootkitBalkanRAT uses a userland rootkit that hooks the NtQuerySystemInformation function to hide the presence of malicious processes.
T1143Hidden WindowBalkanRAT uses 3rd party remote desktop software and hides its window and tray icon in order to hide it from the user.
DiscoveryT1082System Information DiscoveryBalkanRAT collects the computer name and the language settings from the compromised machine.
CollectionT1056Input CaptureBalkanRAT is capable of logging pressed keystrokes.
Command and ControlT1219Remote Access ToolsBalkanRAT has misused legitimate remote desktop software for remote access.


Initial AccessT1192Spearphishing LinkBalkanDoor is distributed via emails that contain links to download malware.
ExecutionT1059Command-Line InterfaceBalkanRAT uses cmd.exe to create a remote shell.
T1106Execution through APIBalkanRAT uses ShellExecuteExW and LoadLibrary APIs to execute files.
T1203Exploitation for Client ExecutionBalkanDoor can be distributed as an ACE archive disguised as a RAR archive, exploiting CVE-2018-20250 vulnerability in WinRAR to execute malicious code.
T1064ScriptingBalkanDoor uses batch scripts for malware installation and execution.
T1035Service ExecutionBalkanDoor’s backdoor can be executed as a service.
T1204User ExecutionBalkanDoor relies on the victim to execute the initial infiltration. The malware is disguised as PDF documents or RAR archives with misleading names, in order to entice the intended victim to click on it.
PersistenceT1050New ServiceBalkanDoor can be installed as a new service, mimicking legitimate Windows services.
T1060Registry Run Keys / Startup FolderBalkanDoor can be installed in the Registry Run key, or dropped in the Startup folder.
Privilege EscalationT1134Access Token ManipulationBalkanDoor is able to create a process under the security context of a different user, using DuplicateTokenEx, SetTokenInformation or CreateProcessAsUserW APIs.
Defense EvasionT1116Code SigningBalkanDoor is digitally signed with code-signing certificates.
T1107File DeletionBalkanDoor deletes files with backdoor commands after the commands have been executed.
T1158Hidden Files and DirectoriesBalkanDoor sets attributes of its files to HIDDEN, SYSTEM and READONLY.
T1036MasqueradingBalkanDoor can be installed as a service with names mimicking legitimate Windows services.
T1108Redundant AccessOperators of BalkanDoor have been seen deploying a second malicious tool (BalkanRAT) to preserve remote access in case BalkanDoor is removed.
DiscoveryT1082System Information DiscoveryBalkanDoor collects the computer name from the compromised machine.
CollectionT1113Screen CaptureBalkanDoor can capture screenshots of the compromised machine.
Command and ControlT1043Commonly Used PortBalkanDoor uses ports 80 and 443 for C&C communication.
T1090Connection ProxyBalkanDoor is capable of identifying a configured proxy server if one exists and then using it to make HTTP requests.
T1008Fallback ChannelsBalkanDoor can communicate over multiple C&C hosts.
T1071Standard Application Layer ProtocolBalkanDoor uses HTTP or HTTPS for network communication.

Sign up to receive an email update whenever a new article is published in our Ukraine Crisis – Digital Security Resource Center