Bumblebee Malware
A new sophisticated loader malware has been identified as part of at least three separate threatening operations. Named the Bumblebee malware, the threat is deployed as an initial-stage malware tasked with the delivery and execution of next-stage payloads. The likely goal of the attackers is to deploy a final ransomware payload to the breached device and the extortion of the affected victims for money.
Details about the threat were revealed to the public in a report by Proofpoint. According to the researchers, the Bumblebee malware may have filled the void left by a previously identified loader threat known as BazaLoader. The groups that utilize Bumblebee malware are believed to be acting as initial-access brokers (IABs). Such cybercrime organizations are focused on infiltrating corporate targets and then selling the established backdoor access to other cybercriminals on the Dark Web.
Threatening Capabilities
Bumblebee demonstrates an expansive range of elaborate evasion techniques, even though the threat is still considered to be under active development. The malware performs checks for sandbox environments or signs of virtualization. It also encrypts its communication with the Command-and-Control (C2, C&C) infrastructure of the attack operations. Bumblebee also scans the running processes on the breached device for common malware analysis tools taken from a hardcoded list.
Another distinguishing characteristic of the threat is that it doesn't use the same process hollowing or DLL injection techniques often observed in similar threats. Instead, Bumblebee utilizes an APC (asynchronous procedure call) injection, which allows it to initiate the shellcode from the incoming commands sent by its C2 server. The first actions taken by the threat once deployed on the targeted machines include the gathering of system information and the generation of a 'Client ID.'
Afterward, Bumblebee will attempt to establish contact with the C2 servers by accessing the associated address stored in plaintext. The versions of the threat analyzed by researchers could recognize several commands, including shellcode injection, DLL injection, initiation of a persistence mechanism, fetching the executables of the next-stage payload and an uninstall option.
