Cybercriminals have adopted a new malware loader called Bumblebee in their malware campaigns that previously used the BazaLoader and IcedID. The loader which is under development is a highly sophisticated malware that first appeared in the threat landscape in March 2022.
The Proofpoint researchers have tracked at least three clusters of activity associated with the distribution of the Bumblebee. The campaigns overlap with activity detailed by the Google Threat Analysis Group in March that aimed at distributing Conti and Diavol ransomware.
Bumblebee implements anti-virtualization checks and a unique implementation of common downloader capabilities, it was observed dropping Cobalt Strike, shellcode, Sliver and Meterpreter.
According to the analysis published by ProofPoint researchers, Bumblebee is a sophisticated malware loader that demonstrates evidence of ongoing development and is used by multiple cybercrime threat actors. Based on the timing of its appearance in the threat landscape and use by multiple cybercriminal groups, it is likely that Bumblebee is, if not a direct replacement for BazaLoader, then a new, multifunctional tool used by actors that historically favored other malware.
In the attacks that used this malware, DocuSign-branded messages were deployed and aimed at tricking recipients into downloading a malicious ISO file hosted on OneDrive.
In one of the paths the experts found that the threat actors send messages containing a “REVIEW THE DOCUMENT” hyperlink, while another one leverages an HTML attachment containing an URL that uses a traffic direction system (TDS) dubbed Prometheus to filter downloads based on the time zone and cookies of the potential victim.
Attackers also tried to abuse the contact form on the target’s website and send to the recipient a message claiming copyright violations of images. The message includes a link to a landing page that directed the user to the download of an ISO file containing “DOCUMENT_STOLENIMAGES.LNK” and “neqw.dll”.
A second campaign was observed in April 2022 involved a thread-hijacking campaign delivering emails that appeared to be the replies to existing benign email conversations with malicious zipped ISO attachments.
In the latest version of the loader employed in the April campaigns, there were significant changes in the functionality of the Bumblebee such as the support for multiple C2s and the addition of an encryption layer to the network communications.
According to the experts, the threat actors using Bumblebee could be initial access brokers that have received the loader from the same threat actors.
The Proofpoint report includes further technical details of the loader and also its Indicators of Compromise (IoCs).
Comments