Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1076124" data-attributes="member: 32260">WHHLight vs. Bumblebee phishing campaign (observed in February 2024)[URL unfurl=&quot;false&quot;]https://malwaretips.com/threads/bumblebee-malware-returns-with-new-tricks-targeting-u-s-businesses.129006/[/URL][URL unfurl=&quot;false&quot;]https://www.proofpoint.com/us/blog/threat-insight/bumblebee-buzzes-back-black[/URL]The targets of that campaign were businesses in the U.S. The Word documents used in the attacks spoofed the consumer electronics company Humane.Attack flow:phishing email with OneDrive URL ----&gt; MS Word document with macro ----&gt;&nbsp; macro creates/executes the VBScript ----&gt;&nbsp; the script executes PowerShell CmdLine ----&gt; CmdLine downloads &amp; executes the second PowerShell CmdLine ----&gt; Bumblebee DLL payload downloaded &amp; executed (via RunDll LOLBin)WHHLight package contains the DocumentsAntiExploit tool that is recommended for hardening MS Office and Adobe Acrobat applications. The applied settings block macros and some other features usually abused by the attackers.But in this thread, I will show how the WHHLight SWH settings can also prevent the attack.<ol>
<li data-xf-list-type="ol">One of the SWH restrictions is blocking Windows Script Host (except whitelisted scripts), so the VBScript file created by the macro is also blocked.</li>
<li data-xf-list-type="ol">Independently of point 1, both PowerShell CmdLines are restricted by Constrained Language Mode (the download method is blocked).</li>
</ol>The attack can be also prevented by the FirewallHardening settings (blocked PowerShell outbound connections).</blockquote>

[QUOTE="Andy Ful, post: 1076124, member: 32260"] [B][SIZE=5]WHHLight vs. Bumblebee phishing campaign (observed in February 2024)[/SIZE][/B] [URL unfurl="false"]https://malwaretips.com/threads/bumblebee-malware-returns-with-new-tricks-targeting-u-s-businesses.129006/[/URL] [URL unfurl="false"]https://www.proofpoint.com/us/blog/threat-insight/bumblebee-buzzes-back-black[/URL] The targets of that campaign were businesses in the U.S. The Word documents used in the attacks spoofed the consumer electronics company Humane. [B][COLOR=rgb(184, 49, 47)]Attack flow:[/COLOR] phishing email with OneDrive URL ----> MS Word document with macro ----> macro creates/executes the VBScript ----> the script executes PowerShell CmdLine ----> CmdLine downloads & executes the second PowerShell CmdLine ----> Bumblebee DLL payload downloaded & executed (via RunDll LOLBin)[/B] WHHLight package contains the DocumentsAntiExploit tool that is recommended for hardening MS Office and Adobe Acrobat applications. The applied settings block macros and some other features usually abused by the attackers. But in this thread, I will show how the [B]WHHLight SWH[/B] settings can also prevent the attack. [LIST=1] [*]One of the SWH restrictions is blocking Windows Script Host (except whitelisted scripts), so the VBScript file created by the macro is also blocked. [*]Independently of point 1, both PowerShell CmdLines are restricted by Constrained Language Mode (the download method is blocked). [/LIST] The attack can be also prevented by the FirewallHardening settings (blocked PowerShell outbound connections). [/QUOTE]

Verification