Cybercriminal actors previously observed delivering BazaLoader and IcedID as part of their malware campaigns are said to have transitioned to a new loader called Bumblebee that’s under active development.
“Based on the timing of its appearance in the threat landscape and use by multiple cybercriminal groups, it is likely Bumblebee is, if not a direct replacement for BazaLoader, then a new, multifunctional tool used by actors that historically favored other malware,” enterprise security firm Proofpoint said in a report shared with The Hacker News.
Campaigns distributing the new highly sophisticated loader are said to have commenced in March 2022, while sharing overlaps with malicious activity leading to the deployment of Conti and Diavol ransomware, raising the possibility that the loader could act as a precursor for ransomware attacks.
“Threat actors using Bumblebee are associated with malware payloads that have been linked to follow-on ransomware campaigns,” the researchers said.
Besides featuring anti-virtualization checks, Bumblebee is written in C++ and is engineered to act as a downloader for retrieving and executing next-stage payloads, including Cobalt Strike, Sliver, Meterpreter, and shellcode.
Interestingly, the increased detection of the malware loader in the threat landscape corresponds to a drop in BazaLoader deployments since February 2022, another popular loader used for delivering file-encrypting malware and developed by the now-defunct TrickBot gang, which has since been absorbed into Conti.
Attack chains distributing Bumblebee have taken the form of DocuSign-branded email phishing lures incorporating fraudulent links or HTML attachments, leading potential victims to a compressed ISO file hosted on Microsoft OneDrive.
What’s more, the embedded URL in the HTML attachment makes use of a traffic direction system (TDS) dubbed Prometheus — which is available for sale on underground platforms for $250 a month — to redirect the URLs to the archive files based on the time zone and cookies of the victims.
The ZIP files, in turn, include .LNK and .DAT files, with the Windows shortcut file executing the latter containing the Bumblebee downloader, before using it to deliver BazaLoader and IcedID malware.
The second campaign in April 2022 involved a thread-hijacking scheme in which legitimate invoice-themed emails were taken over to send zipped ISO files, which were then used to execute a DLL file to activate the loader. Read more:https://bit.ly/3F1rDlf
You can also read this: NPM Bug Allowed Attackers to Distribute Malware as Legitimate Packages