Google ads push BumbleBee malware used by ransomware gangs



The CiscoSetup.exe is the legitimate installer for AnyConnect, installing the application on the device to avoid suspicion.

However, the PowerScrip script installs the BumbleBee malware and conducts malicious activity on the compromised device.

"The PowerShell script contains a selection of renamed functions copied from the PowerSploit ReflectivePEInjection.ps1 script," explains Secureworks.

"It also contains an encoded Bumblebee malware payload that it reflectively loads into memory."

This means that Bumblebee still uses the same post-exploitation framework module to load the malware into memory without raising any alarms from existing antivirus products.

Secureworks found other software packages with similarly named file pairs like ZoomInstaller.exe and zoom.ps1, ChatGPT.msi and chch.ps1 and CitrixWorkspaceApp.exe and citrix.ps1.

A path to ransomware

Considering that the trojanized software is targeting corporate users, infected devices make candidates for the beginning of ransomware attacks.

Secureworks examined one of the recent Bumblebee attacks closely. They found that the threat actor leveraged their access to the compromised system to move laterally in the network approximately three hours after the initial infection.

The tools the attackers deployed on the breached environment include the Cobalt Strike pen-test suite, the AnyDesk and DameWare remote access tools, network scanning utilities, an AD database dumper, and a Kerberos credentials stealer.

This arsenal creates an attack profile that makes it very likely that the malware operators are interested in identifying accessible network points, pivoting to other machines, exfiltrating data, and eventually deploying ransomware.