Beware of Infected (Fake) Installers: BumbleBee Malware Alert

Here are the details

• The page advertised a trojanized MSI installer, ‘cisco-anyconnect-4_9_0195.msi’, that installs BumbleBee malware. Once executed, a PowerShell script and a genuine program installer are copied to the user's system.
• The researchers detected the threat actor moving laterally within a compromised system, deploying Cobalt Strike and remote access tools such as AnyDesk and DameWare. 
• These were dropped into the ‘C:\ProgramData’ directory, indicating that the attacker's aim was likely to deploy ransomware.

Who does it affect?

• The new tactic focuses on remote workers who tend to download software from Google rather than going through their company's tech team, which operates in a more secure environment. 
• This shift from phishing to Google Ads is unsurprising, given that adversaries tend to choose the path of least resistance to achieve their goals. 
• If using Google Ads proves more effective for gaining access to corporate networks, cybercriminals will continue to exploit this method.

Stay safe