Threat intelligence / Malware

BendyBear

[BendyBear](https://attack.mitre.org/software/S0574) is an x64 shellcode for a stage-zero implant designed to download malware from a C2 server. First discovered in August 2020, [BendyBear](https://attack.mitre.org/software/S0574) shares a variety of features with [Waterbear](https://attack.mitre.org/software/S0579), malware previously attributed to the Chinese cyber espionage group [BlackTech](https://attack.mitre.org/groups/G0098).(Citation: Unit42 BendyBear Feb 2021)

Malware

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[BendyBear](https://attack.mitre.org/software/S0574) is an x64 shellcode for a stage-zero implant designed to download malware from a C2 server. First discovered in August 2020, [BendyBear](https://attack.mitre.org/software/S0574) shares a variety of features with [Waterbear](https://attack.mitre.org/software/S0579), malware previously attributed to the Chinese cyber espionage group [BlackTech](https://attack.mitre.org/groups/G0098).(Citation: Unit42 BendyBear Feb 2021)

Labels

malware

11 recorded

Relationships

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to Encrypted/Encoded File

Technique

uses

to Ingress Tool Transfer

Technique

uses

Technique

uses

Technique

uses

to Non-Standard Port

Technique

uses

to Polymorphic Code

Technique

uses

to Query Registry

Technique

uses

to Symmetric Cryptography

Technique

uses

to System Time Discovery

Technique

uses

to Time Based Checks

Technique

3 external

References

mitre-attack

S0574

BendyBear

—

Unit42 BendyBear Feb 2021

https://unit42.paloaltonetworks.com/bendybear-shellcode-blacktech/