Boolka Unveiled: From web attacks to modular malware

Group-IB analysts uncovered operations by a cybercriminal actor called Boolka who used opportunistic SQL injection to inject form‑stealing JavaScript into websites and tested a BeEF‑based malware delivery platform (landing pages like updatebrower.com) to distribute a Python‑based trojan ecosystem (BMANAGER, BMREADER, BMLOG, BMHOOK, BMBACKUP) that performs credential/form theft, keylogging, targeted application monitoring, and file exfiltration; the report provides detailed technical analysis, persistence/C2 behaviors, IoCs (domains, IPs, URLs, file hashes), MITRE mappings, and remediation guidance.