Security News > 2022 > August > Hackers Using Bumblebee Loader to Compromise Active Directory Services

The malware loader known as Bumblebee is being increasingly co-opted by threat actors associated with BazarLoader, TrickBot, and IcedID in their campaigns to breach target networks for post-exploitation activities.

"Bumblebee operators conduct intensive reconnaissance activities and redirect the output of executed commands to files for exfiltration," Cybereason researchers Meroujan Antonyan and Alon Laufer said in a technical write-up.

Bumblebee first came to light in March 2022 when Google's Threat Analysis Group unmasked the activities of an initial access broker dubbed Exotic Lily with ties to the TrickBot and the larger Conti collectives.

The LNK file, for its part, contains the command to launch the Bumblebee loader, which is then used as a conduit for next-stage actions such as persistence, privilege escalation, reconnaissance, and credential theft.

"The time it took between initial access and Active Directory compromise was less than two days," the cybersecurity firm said.

"Attacks involving Bumblebee must be treated as critical, and this loader is known for ransomware delivery."

News URL

https://thehackernews.com/2022/08/hackers-using-bumblebee-loader-to.html