Rewterz Threat Alert – Bumblebee Malware Resurfaces to Target US Organizations in Phishing Attacks – Active IOCs

Severity

High

Analysis Summary

The resurgence of Bumblebee malware in the cybercriminal landscape on February 8, 2024, marks its return after a four-month hiatus. This sophisticated downloader is favored by multiple threat actors but had previously vanished from threat data, only to reappear in a phishing campaign targeting organizations in the United States.

Security researchers have discovered that the malware employs a clever tactic with emails bearing the subject “Voicemail February” from the sender “info@quarlesaa.com” containing OneDrive URLs. The URLs lead to a Word file with names such as “ReleaseEvans#96.docm”, with the digits before the file extension being different. The Word document spoofs the consumer electronics company Humane and the attackers deliver malicious Word documents containing macros disguised as communications from the company.

The document uses macros to create a script in the Windows temporary directory, for example “%TEMP%/radD7A21.tmp”, using the contents of CustomDocumentProperties SpecialProps, SpecialProps1, SpecialProps2, and SpecialProps3. The macro then executes the dropped file using “wscript”. Unlike prior Bumblebee campaigns, this attack chain deviates significantly, utilizing VBA macro-enabled documents, a technique largely abandoned by many cybercriminals due to Microsoft’s default blocking of macros since 2022. Noteworthy is the absence of attribution to a specific threat actor at this time, though similarities in tactics align with previous activities linked to TA579.

The high confidence assessment by researchers suggests that Bumblebee can serve as an initial access point for subsequent ransomware payloads. This development underscores a broader trend of increased cybercriminal activity, as evidenced by the resurgence of other threat actors and malware strains after periods of dormancy, including tax-themed actors TA576 and sophisticated TA866, among others.

The resurgence of Bumblebee and other threat actors coincides with a surge in cybercriminal activity that indicates a heightened operational tempo within the threat landscape. This uptick highlights the resilience and adaptability of threat actors, who continue to innovate new attack chains and tactics to evade detection and deliver updated malware payloads. Researchers expect this heightened activity to persist, necessitating ongoing vigilance and analysis to mitigate emerging threats effectively.

Impact

• Financial Loss
• Data Theft

Indicators of Compromise

Domain Name

q905hr35.life

MD5

• e745d9bb0dd69f151afea9eadc808711
• e815078b81bda42fd1d8029f82f63f8c

SHA-256

• 0cef17ba672793d8e32216240706cf46e3a2894d0e558906a1782405a8f4decf
• c34e5d36bd3a9a6fca92e900ab015aa50bb20d2cd6c0b6e03d070efe09ee689a

SHA-1

• 8b2b5cfc6ffc976a51059a84e020d9459e870bfd
• 6ddae41b0861ff953d261dabd7d63b7ff1dce7e8

URL

• https://1drv.ms/w/s!At-ya4h-odvFe-M3JKvLzB19GQA?e=djPGy
• https://1drv.ms/w/s!AuSuRB5deTxugQ-83_HzIqbBWuE1?e=9f2plW
• http://213.139.205.131/update_ver
• http://213.139.205.131/w_ver.dat

Remediation

• Block all threat indicators at your respective controls.
• Search for Indicators of compromise (IOCs) in your environment utilizing your respective security controls.
• Emails from unknown senders should always be treated with caution.
• Never trust or open links and attachments received from unknown sources/senders.
• Maintain cyber hygiene by updating your anti-virus software and implementing a patch management lifecycle.
• Patch and upgrade any platforms and software timely and make it into a standard security policy. Prioritize patching known exploited vulnerabilities and zero-days.
• Enable antivirus and anti-malware software and update signature definitions on time. Using multi-layered protection is necessary to secure vulnerable assets.
• Maintain daily backups of all computer networks and servers.