Two malware households that suffered setbacks within the aftermath of a coordinated legislation enforcement operation referred to as Endgame have resurfaced as a part of new phishing campaigns.
Bumblebee and Latrodectus, that are each malware loaders, are designed to steal private information, together with downloading and executing further payloads onto compromised hosts.
Tracked below the names BlackWidow, IceNova, Lotus, or Unidentified 111, Latrodectus, can be thought-about to be a successor to IcedID owing to infrastructure overlaps between the 2 malware households. It has been utilized in campaigns related to two preliminary entry brokers (IABs) often known as TA577 (aka Water Curupira) and TA578.
In Might 2024, a coalition of European nations mentioned it dismantled over 100 servers linked to a number of malware strains comparable to IcedID (and, by extension, Latrodectus), SystemBC, PikaBot, SmokeLoader, Bumblebee, and TrickBot.
“Though Latrodectus was not talked about within the operation, it was additionally affected and its infrastructure went offline,” Bitsight safety researcher João Batista famous again in June 2024.
Cybersecurity agency Trustwave, in an evaluation printed earlier this month, described Latrodectus as a “distinct menace” that has acquired a lift following Operation Endgame.
“Whereas initially impacted, Latrodectus shortly rebounded. Its superior capabilities stuffed the void left by its disabled counterparts, establishing itself as a formidable menace,” the cybersecurity firm mentioned.
Assault chains usually leverage malspam campaigns, exploiting hijacked e-mail threads and impersonating reputable entities like Microsoft Azure and Google Cloud to activate the malware deployment course of.
The newly noticed an infection sequence by Forcepoint and Logpoint takes the identical route, with the DocuSign-themed e-mail messages bearing PDF attachments containing a malicious hyperlink or HTML information with embedded JavaScript code which can be engineered to obtain an MSI installer and a PowerShell script, respectively.
Whatever the methodology employed, the assault culminates within the deployment of a malicious DLL file that, in flip, launches the Latrodectus malware.
“Latrodectus leverages older infrastructure, mixed with a brand new, modern malware payload distribution methodology to monetary, automotive, and enterprise sectors,” Forcepoint researcher Mayur Sewani mentioned.
The continued Latrodectus campaigns dovetail with the return of the Bumblebee loader, which employs a ZIP archive file doubtless downloaded by way of phishing emails as a supply mechanism.
“The ZIP file incorporates an LNK file named ‘Report-41952.lnk’ that, as soon as executed, begins a series of occasions to obtain and execute the ultimate Bumblebee payload in reminiscence, avoiding the necessity to write the DLL on disk,” Netskope researcher Leandro Fróes mentioned.
The LNK file is meant to execute a PowerShell command to obtain an MSI installer from a distant server. As soon as launched, the MSI samples, which masquerade as installers from NVIDIA and Midjourney, function a channel to launch the Bumblebee DLL.
“Bumblebee makes use of a stealthier strategy to keep away from the creation of different processes and avoids writing the ultimate payload to disk,” Fróes identified.
“It does so by utilizing the SelfReg desk to power the execution of the DllRegisterServer export operate current in a file within the File desk. The entry within the SelfReg desk works as a key to point what file to execute within the File desk and in our case it was the ultimate payload DLL.”
