Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Flight of the Bumblebee: Email Lures and File Sharing Services Lead to Malware

Summary: Projector Libra, also known as EXOTIC LILY, an initial access broker tied to Conti ransomware, corresponded directly with a target by email and then sent malware through the legitimate file-sharing service TransferXL, whose links expire after one week. The downloaded ZIP held an ISO image with a Windows shortcut that ran a hidden copy of the 7-Zip console to extract a password-protected Bumblebee DLL, which was executed with rundll32 and led to Cobalt Strike traffic roughly 15 minutes after Bumblebee command-and-control began.

Why it matters: The loader here is a legitimate file-sharing service and a signed, unmodified 7-Zip binary, so the delivery chain relies on tools your users and your allowlists already trust. In this case the Cobalt Strike traffic stopped after one hour and 11 minutes because the target was not high-value, which is the only reason the chain did not continue to lateral movement and ransomware such as Conti or Diavol.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related