{"id":480,"date":"2022-05-24T15:00:52","date_gmt":"2022-05-24T15:00:52","guid":{"rendered":"https:\/\/www.maisetechnology.com\/?p=480"},"modified":"2022-11-10T17:40:48","modified_gmt":"2022-11-10T17:40:48","slug":"new-delivery-method-for-ransomware-discovered-called-bumblebee","status":"publish","type":"post","link":"https:\/\/www.maisetechnology.com\/2022\/05\/24\/new-delivery-method-for-ransomware-discovered-called-bumblebee\/","title":{"rendered":"New Delivery Method For Ransomware Discovered Called Bumblebee"},"content":{"rendered":"<div class=\"wpb-content-wrapper\"><p>[vc_row][vc_column][vc_column_text]<img loading=\"lazy\" decoding=\"async\" class=\"alignleft size-full wp-image-14506\" src=\"\/wp-content\/uploads\/2022\/09\/bee-resized.png\" alt=\"New Delivery Method For Ransomware Discovered Called Bumblebee\" width=\"300\" height=\"225\" \/>Some interesting and disturbing changes are afoot in the hacking world.\u00a0 It appears that the TrickBot gang is now working for the Conti Syndicate. TrickBot is a well-known group of botnet developers responsible for the creation of the BazarLoader. BazarLoader has been used by Conti in the past as their delivery system of choice when it comes to delivering ransomware as part of one of their sophisticated phishing campaigns.<\/p>\n<p>Now though, the Conti Syndicate has a new tool at their disposal.\u00a0 A newly developed malware loader dubbed Bumblebee.\u00a0 Eli Salem is a seasoned malware reverse engineer at Cyberreason. Salem says that the techniques used by Bumblebee are similar to those used by BazarLoader. This suggests that they were developed by the same team, which points the way back to TrickBot.<\/p>\n<p>So TrickBot&#8217;s developers made a new toy for the Conti Syndicate. Since Bumblebee became available, security researchers at Proofpoint and other organizations have been seeing evidence that other groups are switching away from BazarLoader and IcedID (also highly similar) in preference for Bumblebee.<\/p>\n<p>Although similar in its overall structure to BazarLoader, Bumblebee appears to be a more advanced version.<\/p>\n<p><strong>It can \u00a0support a wide range of commands, including but not limited to:<\/strong><\/p>\n<ul>\n<li>Shi: shellcode injection<\/li>\n<li>Dij: DLL injection in the memory of other processes<\/li>\n<li>Dex: Download executable<\/li>\n<li>dl: uninstall loader<\/li>\n<li>And Ins: enable persistence via a scheduled task for a Visual Basic Script that loads Bumblebee<\/li>\n<\/ul>\n<p>Worse is that there is clear evidence that Bumblebee is being actively developed and gains new features and capabilities with every update.<\/p>\n<p>As of the update observed on April 19th, for example, the malicious code now supports multiple command-and-control servers. The development team has recently added an encryption layer that makes it more difficult to track communications to and from the command-and-control server.<\/p>\n<p>What this means in terms of the bigger picture is anyone&#8217;s guess. It seems clear that there&#8217;s a growing level of cooperation and coordination in the hacking world lately, and that should scare just about everyone.[\/vc_column_text][\/vc_column][\/vc_row]<\/p>\n<\/div>","protected":false},"excerpt":{"rendered":"<p>[vc_row][vc_column][vc_column_text]Some interesting and disturbing changes are afoot in the hacking world.\u00a0 It appears that the TrickBot gang is now working for the Conti Syndicate. TrickBot is a well-known group of botnet developers responsible for the creation of the BazarLoader. BazarLoader has been used by Conti in the past as their delivery system of choice when&hellip;<\/p>\n","protected":false},"author":2,"featured_media":481,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[11],"tags":[13,36,16,18,17],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v22.5 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>New Delivery Method For Ransomware Discovered Called Bumblebee | Maise Technology<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.maisetechnology.com\/2022\/05\/24\/new-delivery-method-for-ransomware-discovered-called-bumblebee\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"New Delivery Method For Ransomware Discovered Called Bumblebee | Maise Technology\" \/>\n<meta property=\"og:description\" content=\"[vc_row][vc_column][vc_column_text]Some interesting and disturbing changes are afoot in the hacking world.\u00a0 It appears that the TrickBot gang is now working for the Conti Syndicate. TrickBot is a well-known group of botnet developers responsible for the creation of the BazarLoader. BazarLoader has been used by Conti in the past as their delivery system of choice when&hellip;\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.maisetechnology.com\/2022\/05\/24\/new-delivery-method-for-ransomware-discovered-called-bumblebee\/\" \/>\n<meta property=\"og:site_name\" content=\"Maise Technology\" \/>\n<meta property=\"article:published_time\" content=\"2022-05-24T15:00:52+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2022-11-10T17:40:48+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.maisetechnology.com\/wp-content\/uploads\/2022\/09\/bee-resized.png\" \/>\n\t<meta property=\"og:image:width\" content=\"300\" \/>\n\t<meta property=\"og:image:height\" content=\"225\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"maisegroup\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"maisegroup\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.maisetechnology.com\/2022\/05\/24\/new-delivery-method-for-ransomware-discovered-called-bumblebee\/\",\"url\":\"https:\/\/www.maisetechnology.com\/2022\/05\/24\/new-delivery-method-for-ransomware-discovered-called-bumblebee\/\",\"name\":\"New Delivery Method For Ransomware Discovered Called Bumblebee | Maise Technology\",\"isPartOf\":{\"@id\":\"https:\/\/www.maisetechnology.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.maisetechnology.com\/2022\/05\/24\/new-delivery-method-for-ransomware-discovered-called-bumblebee\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.maisetechnology.com\/2022\/05\/24\/new-delivery-method-for-ransomware-discovered-called-bumblebee\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.maisetechnology.com\/wp-content\/uploads\/2022\/09\/bee-resized.png\",\"datePublished\":\"2022-05-24T15:00:52+00:00\",\"dateModified\":\"2022-11-10T17:40:48+00:00\",\"author\":{\"@id\":\"https:\/\/www.maisetechnology.com\/#\/schema\/person\/eb4c832909343bad9b29835cbde276a5\"},\"breadcrumb\":{\"@id\":\"https:\/\/www.maisetechnology.com\/2022\/05\/24\/new-delivery-method-for-ransomware-discovered-called-bumblebee\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.maisetechnology.com\/2022\/05\/24\/new-delivery-method-for-ransomware-discovered-called-bumblebee\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.maisetechnology.com\/2022\/05\/24\/new-delivery-method-for-ransomware-discovered-called-bumblebee\/#primaryimage\",\"url\":\"https:\/\/www.maisetechnology.com\/wp-content\/uploads\/2022\/09\/bee-resized.png\",\"contentUrl\":\"https:\/\/www.maisetechnology.com\/wp-content\/uploads\/2022\/09\/bee-resized.png\",\"width\":300,\"height\":225,\"caption\":\"New Delivery Method For Ransomware Discovered Called Bumblebee\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.maisetechnology.com\/2022\/05\/24\/new-delivery-method-for-ransomware-discovered-called-bumblebee\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.maisetechnology.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"New Delivery Method For Ransomware Discovered Called Bumblebee\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.maisetechnology.com\/#website\",\"url\":\"https:\/\/www.maisetechnology.com\/\",\"name\":\"Maise Technology\",\"description\":\"Just another WordPress site\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.maisetechnology.com\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.maisetechnology.com\/#\/schema\/person\/eb4c832909343bad9b29835cbde276a5\",\"name\":\"maisegroup\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.maisetechnology.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/253b0df440d3cf0019e97554b1e058c6?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/253b0df440d3cf0019e97554b1e058c6?s=96&d=mm&r=g\",\"caption\":\"maisegroup\"},\"url\":\"https:\/\/www.maisetechnology.com\/author\/maisegroup\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"New Delivery Method For Ransomware Discovered Called Bumblebee | Maise Technology","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.maisetechnology.com\/2022\/05\/24\/new-delivery-method-for-ransomware-discovered-called-bumblebee\/","og_locale":"en_US","og_type":"article","og_title":"New Delivery Method For Ransomware Discovered Called Bumblebee | Maise Technology","og_description":"[vc_row][vc_column][vc_column_text]Some interesting and disturbing changes are afoot in the hacking world.\u00a0 It appears that the TrickBot gang is now working for the Conti Syndicate. TrickBot is a well-known group of botnet developers responsible for the creation of the BazarLoader. BazarLoader has been used by Conti in the past as their delivery system of choice when&hellip;","og_url":"https:\/\/www.maisetechnology.com\/2022\/05\/24\/new-delivery-method-for-ransomware-discovered-called-bumblebee\/","og_site_name":"Maise Technology","article_published_time":"2022-05-24T15:00:52+00:00","article_modified_time":"2022-11-10T17:40:48+00:00","og_image":[{"width":300,"height":225,"url":"https:\/\/www.maisetechnology.com\/wp-content\/uploads\/2022\/09\/bee-resized.png","type":"image\/png"}],"author":"maisegroup","twitter_card":"summary_large_image","twitter_misc":{"Written by":"maisegroup","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.maisetechnology.com\/2022\/05\/24\/new-delivery-method-for-ransomware-discovered-called-bumblebee\/","url":"https:\/\/www.maisetechnology.com\/2022\/05\/24\/new-delivery-method-for-ransomware-discovered-called-bumblebee\/","name":"New Delivery Method For Ransomware Discovered Called Bumblebee | Maise Technology","isPartOf":{"@id":"https:\/\/www.maisetechnology.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.maisetechnology.com\/2022\/05\/24\/new-delivery-method-for-ransomware-discovered-called-bumblebee\/#primaryimage"},"image":{"@id":"https:\/\/www.maisetechnology.com\/2022\/05\/24\/new-delivery-method-for-ransomware-discovered-called-bumblebee\/#primaryimage"},"thumbnailUrl":"https:\/\/www.maisetechnology.com\/wp-content\/uploads\/2022\/09\/bee-resized.png","datePublished":"2022-05-24T15:00:52+00:00","dateModified":"2022-11-10T17:40:48+00:00","author":{"@id":"https:\/\/www.maisetechnology.com\/#\/schema\/person\/eb4c832909343bad9b29835cbde276a5"},"breadcrumb":{"@id":"https:\/\/www.maisetechnology.com\/2022\/05\/24\/new-delivery-method-for-ransomware-discovered-called-bumblebee\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.maisetechnology.com\/2022\/05\/24\/new-delivery-method-for-ransomware-discovered-called-bumblebee\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.maisetechnology.com\/2022\/05\/24\/new-delivery-method-for-ransomware-discovered-called-bumblebee\/#primaryimage","url":"https:\/\/www.maisetechnology.com\/wp-content\/uploads\/2022\/09\/bee-resized.png","contentUrl":"https:\/\/www.maisetechnology.com\/wp-content\/uploads\/2022\/09\/bee-resized.png","width":300,"height":225,"caption":"New Delivery Method For Ransomware Discovered Called Bumblebee"},{"@type":"BreadcrumbList","@id":"https:\/\/www.maisetechnology.com\/2022\/05\/24\/new-delivery-method-for-ransomware-discovered-called-bumblebee\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.maisetechnology.com\/"},{"@type":"ListItem","position":2,"name":"New Delivery Method For Ransomware Discovered Called Bumblebee"}]},{"@type":"WebSite","@id":"https:\/\/www.maisetechnology.com\/#website","url":"https:\/\/www.maisetechnology.com\/","name":"Maise Technology","description":"Just another WordPress site","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.maisetechnology.com\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/www.maisetechnology.com\/#\/schema\/person\/eb4c832909343bad9b29835cbde276a5","name":"maisegroup","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.maisetechnology.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/253b0df440d3cf0019e97554b1e058c6?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/253b0df440d3cf0019e97554b1e058c6?s=96&d=mm&r=g","caption":"maisegroup"},"url":"https:\/\/www.maisetechnology.com\/author\/maisegroup\/"}]}},"_links":{"self":[{"href":"https:\/\/www.maisetechnology.com\/wp-json\/wp\/v2\/posts\/480"}],"collection":[{"href":"https:\/\/www.maisetechnology.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.maisetechnology.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.maisetechnology.com\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.maisetechnology.com\/wp-json\/wp\/v2\/comments?post=480"}],"version-history":[{"count":3,"href":"https:\/\/www.maisetechnology.com\/wp-json\/wp\/v2\/posts\/480\/revisions"}],"predecessor-version":[{"id":905,"href":"https:\/\/www.maisetechnology.com\/wp-json\/wp\/v2\/posts\/480\/revisions\/905"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.maisetechnology.com\/wp-json\/wp\/v2\/media\/481"}],"wp:attachment":[{"href":"https:\/\/www.maisetechnology.com\/wp-json\/wp\/v2\/media?parent=480"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.maisetechnology.com\/wp-json\/wp\/v2\/categories?post=480"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.maisetechnology.com\/wp-json\/wp\/v2\/tags?post=480"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}