Ankura CTIX FLASH Update - April 25, 2023

Malware Activity

Bumblebee Malware Loader Observed Infecting Machines through Fraudulent Software Installers

"Bumblebee," a malware loader discovered in April 2022, has been observed in a new campaign utilizing Google advertisements and SEO poisoning to target enterprises with promoted trojanized versions of popular applications, such as Cisco AnyConnect Secure Mobility Client, Zoom, ChatGPT, and Citrix. Bumblebee is often seen in phishing campaigns that deliver "payloads commonly associated with ransomware deployments" and has been actively evolving since its creation. Researchers emphasized that trojanizing installers for software that are "particularly topical (e.g., ChatGPT)" or often used by remote workers increases the likelihood of new infections. It has been observed that once Bumblebee has infected a victim device, the threat actor responsible moves laterally roughly three (3) hours after the initial infection and deploys Cobalt Strike as well as the