<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof ContentPasted0">
Hello,
<div><br class="ContentPasted0">
</div>
<div class="ContentPasted0">I hope everyone is doing well!</div>
<div><br class="ContentPasted0">
</div>
<div class="ContentPasted0">Below is the entry for today.</div>
<div><br class="ContentPasted0">
</div>
<div class="ContentPasted0">10/03/2022 - Diary entry #607:</div>
<div><br class="ContentPasted0">
</div>
<blockquote style="margin-top:0;margin-bottom:0">
<div class="ContentPasted0 ContentPasted1">Bumblebee is a very advanced malware-as-a-service threat – covered in our Daily Diaries #499, #541, and #592 – that targets Windows systems using a highly obfuscated DLL and advanced anti-analysis techniques. Bumblebee
was found to replace BazaLoader as the infection vector in some campaigns in April this year. Since then, it has been adopted by different threat actors due to its success and constant evolution.
<div><br class="ContentPasted1">
</div>
<div class="ContentPasted1">Recently, it was revealed that attackers shifted their focus from testing Bumblebee to infecting as many victims as possible, increasing the volume of Command & Control traffic. The loader’s system was also suddenly changed from
using ISO files to VHD files containing a PowerShell script, then back again in a matter of days. Finally, the variety of payloads delivered by Bumblebee changed based on the type of victim, delivering banking trojans and info stealers to standalone hosts
and post-exploitation tools such as CobaltStrike to organizations.</div>
<div><br class="ContentPasted1">
</div>
Therefore, as Bumblebee gets increasingly adopted and improved, we expect a rise in cyber attacks involving this malware. However, the fact that Bumblebee is a unique malware loader can help on identifying and blocking it.<br>
</div>
</blockquote>
<div><br class="ContentPasted0">
</div>
Kind Regards,<br>
</div>
<div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="Signature">
<div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<table style="font-size:medium; font-family:"Times New Roman"">
<tbody>
<tr>
<td style="width:180px" align="left">
<table width="120" align="left">
<tbody>
<tr>
<td colspan="3" align="center"><a href="https://www.appgate.com/" target="_blank" rel="noopener noreferrer" style="margin:0px"><img style="margin:0px" width="120" height="30" src="https://d3aafpijpsak2t.cloudfront.net/images/Signature/logo@2x.png"></a></td>
</tr>
<tr>
<td colspan="3" align="center"> </td>
</tr>
<tr>
<td width="37%" align="center"><a href="https://www.linkedin.com/company/appgate-security/" target="_blank" rel="noopener noreferrer" style="margin:0px"><img style="margin:0px" width="18" height="18" src="https://d3aafpijpsak2t.cloudfront.net/images/Signature/likedin@2x.png"></a></td>
<td width="28%"><a href="https://twitter.com/AppgateSecurity" target="_blank" rel="noopener noreferrer" style="margin:0px"><img style="margin:0px" width="20" height="18" src="https://d3aafpijpsak2t.cloudfront.net/images/Signature/twitter@2x.png"></a></td>
<td width="35%"><a href="https://www.youtube.com/channel/UC-8GvxcZbm-R3EJNl8jYjiQ" target="_blank" rel="noopener noreferrer" style="margin:0px"><img style="width: 26px; height: 18px; max-width: initial;" width="26" height="18" src="https://d3aafpijpsak2t.cloudfront.net/images/Signature/youtube@2x.png"></a></td>
</tr>
</tbody>
</table>
<p style="margin-top:0px; margin-bottom:0px"> </p>
</td>
<td colspan="2" rowspan="2" style="width:350px">
<p style="color:rgb(12,12,12); font-size:13px; font-family:Arial,Helvetica,sans-serif; margin-top:0px; margin-bottom:0px">
<strong>MART</strong><br>
</p>
<p style="color:rgb(12,12,12); font-size:13px; font-family:Arial,Helvetica,sans-serif; margin-top:0px; margin-bottom:0px">
Malware Analysis and Research Team<br>
</p>
<p style="color:rgb(12,12,12); font-size:13px; font-family:Arial,Helvetica,sans-serif; margin-top:0px; margin-bottom:0px">
<strong>Appgate</strong></p>
<p style="color:rgb(12,12,12); font-size:13px; font-family:Arial,Helvetica,sans-serif; margin-top:0px; margin-bottom:0px">
E:<span style="margin:0px"> <a href="mailto:ctas-mat@appgate.com" title="mailto:ctas-mat@appgate.com">
ctas-mat@appgate.com</a></span><br>
</p>
<p style="color:rgb(12,12,12); font-size:13px; font-family:Arial,Helvetica,sans-serif; margin-top:0px; margin-bottom:0px">
<br>
<span style="margin:0px; background-color:white"></span></p>
</td>
</tr>
</tbody>
</table>
<br>
</div>
</div>
</div>
</div>
</body>
</html>