Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Buzzing in the Background: BumbleBee, a New Modular Backdoor Evolved From BookWorm

BumbleBee is a modular backdoor malware that evolved from the previously known BookWorm backdoor. It employs a variety of sophisticated techniques to maintain persistence, evade detection, and facilitate remote control by threat actors. BumbleBee uses process injection (MITRE ATT&CK T1055) to execute malicious code within legitimate processes, thereby hiding its presence. It hijacks execution flow (T1574) and modifies system processes (T1543) to establish persistence, including through boot or logon autostart execution (T1547) and initialization scripts (T1037). The malware also incorporates execution guardrails (T1480) to limit its activity to specific environments, reducing the chance of accidental discovery. BumbleBee performs indicator removal on the host (T1070) to erase traces of its activity and uses keylogging and input capture techniques (T1056.001, T1056, T1417) to steal sensitive information. It gathers victim host information (T1592) to tailor its operations and uses web protocols (T1071.001) for command and control communications, often employing proxies (T1090) to obfuscate network traffic. Symmetric cryptography (T1573.001) is used to secure communications and payloads, complicating detection and analysis. BumbleBee’s modular architecture allows it to load and execute various payloads dynamically, increasing its flexibility and adaptability. Although no known exploits in the wild have been reported, its medium threat level and extensive use of stealth and persistence techniques make it a significant threat to targeted environments.

Detailed information about Buzzing in the Background: BumbleBee, a New Modular Backdoor Evolved From BookWorm. Get real-time updates, technical details, and mit

Buzzing in the Background: BumbleBee, a New Modular Backdoor Evolved From BookWorm - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - BfV Cyber-Brief Nr. 01/2019 - Hinweis auf aktuelle Angriffskampagne -

The threat described is an ongoing cyber attack campaign identified by the German Federal Office for the Protection of the Constitution (BfV) and reported via OSINT sources. The campaign is attributed to the threat actor group known as Axiom, which is known for sophisticated cyber espionage activities. The attack leverages a wide range of advanced techniques mapped to MITRE ATT&CK patterns, indicating a multi-faceted and persistent intrusion approach. Key tactics include exploitation of external remote services (T1133), command-line interface usage (T1059), execution through APIs (T1106), and execution via rundll32 (T1085). The attackers also employ service execution (T1035), user execution (T1204), and DLL search order hijacking (T1038) to maintain persistence and evade detection. Kernel modules and extensions (T1215) and rootkits (T1014) suggest deep system compromise capabilities. Additional evasion techniques include disabling security tools (T1089), timestomping (T1099), binary padding (T1009), and software packing (T1045). The campaign uses custom command and control protocols (T1094), connection proxies (T1090), and fallback channels (T1008) to maintain resilient communications. The use of port knocking (T1205) and commonly used ports (T1043) further complicates detection. The campaign also manipulates system registries (T1112), deletes files (T1107), and employs process injection (T1055) to hide malicious activities. Execution guardrails (T1480) indicate targeted execution based on environment checks. Code signing (T1116) and deobfuscation techniques (T1140) are used to bypass security mechanisms. The campaign’s high severity rating and the broad spectrum of sophisticated techniques suggest a well-resourced and highly capable adversary focused on stealth, persistence, and data exfiltration. No specific affected software versions are listed, and no known exploits in the wild are reported, but the campaign’s complexity and persistence pose a significant threat to targeted organizations.

Detailed information about OSINT - BfV Cyber-Brief Nr. 01/2019 - Hinweis auf aktuelle Angriffskampagne -. Get real-time updates, technical details, and mitigati

Title	Severity	Type	Source	Date

Threats Tagged 'misp-galaxy:mitre-attack-pattern="execution guardrails - t1480"'

Filter Threats