Bumblebee malware wakes from hibernation, forgets what year it is, attacks with macros

The Bumblebee malware loader seemingly vanished from the internet last October, but it's back and - oddly - relying on a vintage vector to try and gain access. First spotted in 2022 by researchers at Proofpoint – who identified it as an apparent replacement for BazarLoader – Bumblebee was originally used by high-profile …

[Pascal Monett]

"Organizations should train users"

Yeah, they should.

But that costs money and spending money on a problem that hasn't yet happened isn't in their DNA.

They'll run around like headless chickens when they've been pwned. Then spending money will be justified.

[seven of five]

quarlesaa domain owner

> We've asked to see if the owner is aware that its email system is being used to send malicious emails but haven't heard back.

Have you checked your voicemail?

[Martin Summers]

Yeah disabling macros was fantastic, until the accounts team with their ancient spreadsheets started complaining they couldn't do their jobs. Not to mention had no idea how to create a new sheet or use Power BI and the person that originally created the sheets left years ago. So yeah, guess who had to turn the macros back on. I suspect lots of companies probably have too.

[imanidiot]

"We've asked to see if the owner is aware that its email system is being used to send malicious emails but haven't heard back"

Are they actually using their mailsystem? Or just spoofing their adress?

[David Hicklin]

>Or just spoofing their address?

My thought exactly, most spam that makes it through at home has spoofed addresses