New wave of Bumblebee malware attacks warned
Essential information
- Published
- 22/10/2024 15:49
- Modified
- 22/10/2024 17:25
- Tags
- 2024-10-22 bumblebee evasion in-memory loader malware msi phishing ransomware
- Related entities
- 9 observables, 1 intrusion sets (apt), 8 techniques (mitre), 1 malware
Description
Security researchers have detected new attacks involving the Bumblebee malware loader, just four months after Europol disrupted its operations in Operation Endgame. The malware has resurfaced with updated tactics, using MSI files disguised as legitimate software installers to deliver its payload directly into memory without dropping files to disk. It also avoids creating new processes by leveraging the MSI SelfReg table to execute malicious DLLs. The Bumblebee campaigns likely begin with phishing emails containing ZIP files with malicious LNK files that initiate the infection chain. This marks the first major reappearance of Bumblebee since the law enforcement takedown in May 2024.