Hackers Using Bumblebee Loader to Compromise Active Directory Services (29th August 2022)

Ref# AL2022_53 | Date: Aug 29th 2022

What is Bumblebee Malware? 

Bumblebee, a malware loader (Small malicious programs that download and execute additional payloads on compromised machines without being detected.), is increasingly being used by threat actors associated with BazarLoader, TrickBot, and IcedID in their campaigns to breach target networks for post-exploitation activities. Any organization that discovers a Bumblebee infection on its network should treat it seriously because it could be the gateway to several dangerous ransomware threats. Bumblebee is distributed in the form of ISO files that contain malicious DLL and shortcut files (files containing Bumblebee malware). It is highly sophisticated malware that employs a variety of techniques to avoid detection. To avoid running on virtual machines, it can detect virtualization environment processes.  Bumblebee malware”s purpose is to download and execute additional payloads in order to infect computers with other malware. There is evidence that Bumblebee is frequently used by ransomware gangs to encrypt files and force victims to pay a ransom in exchange for a decryption tool.

Technical Details     

Malspam campaigns are used by threat actors to deliver Bumblebee. They send emails with malicious attachments (an ISO file). That ISO file contains malicious.dll files as well as shortcut files (DLL and LNK files) containing Bumblebee. The Bumblebee downloader begins after the shortcut (LNK/.lnk) file is executed. Threat actors employ Malware can be delivered via Microsoft Office, PDF documents, executable files, JavaScript files, and other files. Emails with malicious links or files are typically disguised as important/urgent/official letters from legitimate companies or other entities. Cybercriminals may use Bumblebee to inject information stealers, cryptocurrency miners, and other malware because it is designed to drop additional payloads. The C2 (Command and Control) server sends commands to Bumblebee. It is used by attackers to download and execute files directly, inject malicious DLLs, and establish persistence on the operating system. 

A list of Indicators of Compromise (IOC) and techniques used by threat actors to deliver Bumblebee Malware can be found at the following URL:

https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bumblebee-loader-cybercrime

Mitigation 

Prevention is always preferable to cure. Continuing to follow good cybersecurity hygiene and best practices is the most effective way to protect your company from malware. Here are some best practices to consider:

Educate employees 

Employees should be educated on the latest malware and how it behaves or attacks a system. Additionally, businesses should teach their employees not to download files and email attachments from unknown emails, malicious links, or unofficial websites. 

Limit application privileges and follow the principle of least privilege. 

Organizations should apply the “principle of least privilege” and provide employees with the bare minimum of system requirements and usability. Furthermore, not everyone should be granted permission to download and run any file from the internet. 

Use anti-malware and anti-spyware

Anti-malware and anti-spyware programs that are regularly updated and patched should be installed on enterprise systems to detect any malware. Some antivirus and anti-malware programs that can detect Bumblebee malware include Combo Cleaner, EST NOD-32, Fortinet, and Comodo. 

If necessary, use an administrative account. 

Bumblebee malware can use administrative privileges to gain access to or exploit other computer components. It is not advised to download anything suspicious via email using administrative accounts. Employees and IT professionals should only log in to administrative accounts to perform privileged tasks such as granting user access or changing configuration. 

The Guyana National CIRT recommends that users and administrators review these recommendations and implement them where necessary. 

PDF Download: Hackers Using Bumblebee Loader to Compromise Active Directory Services.pdf

References