Bumblebee Malware Returns with New Tricks, Targeting U.S. Businesses

The infamous malware loader and preliminary accessibility broker recognized as Bumblebee has resurfaced just after a 4-thirty day period absence as element of a new phishing campaign noticed in February 2024.

Organization security agency Proofpoint explained the action targets organizations in the U.S. with voicemail-themed lures containing one-way links to OneDrive URLs.

“The URLs led to a Term file with names such as “ReleaseEvans#96.docm” (the digits just before the file extension varied),” the business reported in a Tuesday report. “The Phrase doc spoofed the customer electronics corporation Humane.”

✔ Approved From Our Partners

Protect and backup your data using AOMEI Backupper. AOMEI Backupper takes secure and encrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper you will never be worried about loosing your data anymore.

Get AOMEI Backupper with 72% discount from an authorized distrinutor of AOMEI: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code

Opening the document leverages VBA macros to start a PowerShell command to down load and execute another PowerShell script from a distant server that, in switch, retrieves and operates the Bumblebee loader.

Bumblebee, first spotted in March 2022, is generally built to download and execute adhere to-on payloads such as ransomware. It has been put to use by multiple crimeware threat actors that beforehand noticed delivering BazaLoader (aka BazarLoader) and IcedID.

It’s also suspected to be designed by danger actors the Conti and TrickBot cybercrime syndicate as a replacement for BazarLoader. In September 2023, Intel 471 disclosed a Bumblebee distribution campaign that utilized Web Dispersed Authoring and Versioning (WebDAV) servers to disseminate the loader.

The attack chain is noteworthy for its reliance on macro-enabled documents in the attack chain, in particular taking into consideration Microsoft began blocking macros in Place of work documents downloaded from the internet by default setting up July 2022, prompting risk actors to modify and diversify their techniques.

The return of Bumblebee also coincides with the reappearance of new variants of QakBot, ZLoader, and PikaBot, with samples of QakBot distributed in the sort of Microsoft Application Installer (MSI) documents.

“The .MSI drops a Windows .cab (Cabinet) archive, which in convert is made up of a DLL,” cybersecurity organization Sophos mentioned on Mastodon. “The .MSI extracts the DLL from the .taxi, and executes it utilizing shellcode. The shellcode will cause the DLL to spawn a second copy of by itself and inject the bot code into the next instance’s memory place.”

The newest QakBot artifacts have been located to harden the encryption employed to conceal strings and other information and facts, which includes using a crypter malware termed DaveCrypter, generating it much more hard to examine. The new era also reinstates the capability to detect irrespective of whether the malware was managing inside of a digital machine or sandbox.

A different important modification consists of encrypting all communications concerning the malware and the command-and-handle (C2) server employing AES-256, a more robust system than was applied in variations prior to the dismantling of QakBot’s infrastructure in late August 2023.

“The takedown of the QakBot botnet infrastructure was a victory, but the bot’s creators continue to be no cost, and a person who has access to QakBot’s unique resource code has been experimenting with new builds and testing the waters with these newest variants,” Andrew Brandt, principal researcher at Sophos X-Ops, reported.

“A single of the most notable variations require a adjust to the encryption algorithm the bot makes use of to conceal default configurations hardcoded into the bot, creating it far more tricky for analysts to see how the malware operates the attackers are also restoring formerly deprecated attributes, these kinds of as virtual device (VM) consciousness, and screening them out in these new variations.”

The development arrives as Malwarebytes revealed a new campaign in which phishing websites mimicking fiscal establishments like Barclays trick possible targets into downloading respectable remote desktop software like AnyDesk to purportedly resolve non-existent issues and eventually make it possible for menace actors to acquire handle of the equipment.

Observed this report interesting? Comply with us on Twitter  and LinkedIn to go through far more unique articles we put up.