Hackers Deploy New Malware Loader Called "Bumblebee"
Researchers discovered a new malware loader being used in the wild. The tool is called "Bumblebee" and is associated with several different cybercriminal outfits.
The team that picked apart the new malware loader is with security firm Proofpoint. The team was tracking several "crimeware threat outfits" who were previously using a couple of different loaders to spread malware, called "BazaLoader" and "IcedID". Now it seems the outfits using BazaLoader have entirely switched to using Bumblebee, as Proofpoint has not detected a single instance of the old tool since February 2022.
BazaLoader replaced by Bumblebee
Proofpoint's observations overlap with data collected by the Google Threat Analysis Group. According to the report, after BazaLoader disappeared from the online landscape in February, it was replaced by Bumblebee, with the first sightings of the new loader in the wild dating to March 2022.
The researchers believe Bumblebee is still being actively developed, but despite this, the loader already sports a number of advanced features. Those include advanced checks to dodge virtual sandboxes and original variations of commonly used downloader functionality.
Attack uses malicious archive and ISO file
Bumblebee is being used in malicious email campaigns. Lures include links urging the victim to "REVIEW THE DOCUMENT", with the email claiming an invoice is on the other end of the link. What is really on the other end is a disk image .iso file, zipped up in an archive file and hosted on OneDrive.
Opening the zip file reveals the .iso inside it. Once that is opened too, it shows two files inside it. Both of them are named "Attachment". One is a .lnk shortcut file, the other is a .dat file that is just over 2 megabytes in size.
If the shortcut file is executed, it loads up Bumblebee from the .dat file and deploys the loader.
Proofpoint believes the campaign currently using Bumblebee is run by the threat actor going by the handle TA579.
Several other similar campaigns were also observed, one using email thread hijacking, another was abusing emails that were generated using the "Contact us" section on websites. Delivery methods were similar, with a differently named payload and a shortcut .lnk file being used again.
According to Proofpoint, the loader can be used as a tool for gaining access to a network and delivering secondary payloads, including ransomware.
