FlagThis

The official RVTools site has been compromised, leading to the distribution of Bumblebee malware through a trojanized installer. Arctic Wolf has observed this malicious activity, noting that the compromised installer was being spread through a typosquatted domain, making it difficult for users to discern the legitimate source from the fake one. RVTools, developed by Robware, is a popular VMware utility used for inventory and configuration reporting, making it a valuable target for attackers aiming to compromise IT environments. The incident highlights the risks associated with supply chain attacks, where trusted software is used to deliver malware.

This incident was discovered after a cybersecurity practitioner and threat analyst at ZeroDay Labs identified a suspicious file, version.dll, attempting to execute from within the RVTools installer directory. The file was flagged by Microsoft Defender for Endpoint, raising immediate concerns. Analysis revealed that 33 out of 71 antivirus engines on VirusTotal detected the file as malicious, classifying it as a Bumblebee loader variant. The Bumblebee loader is known for its role in delivering post-exploitation frameworks like Cobalt Strike and facilitating ransomware deployment, indicating a serious threat to affected systems.

Following the discovery of the trojanized installer, Robware took its official websites, robware.net and RVTools.com, offline. The company issued a statement advising users to only download RVTools software from authorized sources and to avoid downloading it from any other websites or sources. As an interim measure, users are advised to verify the installer's hash and review any execution of version.dll from user directories. The incident serves as a reminder of the importance of vigilance when downloading software and the potential dangers of downloading software from untrusted sources.

ImgSrc: arcticwolf.com

References :

• Arctic Wolf: RVTools Supply Chain Attack Delivers Bumblebee Malware
• securityonline.info: RVTools Supply Chain Attack: Bumblebee Malware Delivered via Trusted VMware Utility
• The Hacker News: RVTools Official Site Hacked to Deliver Bumblebee Malware via Trojanized Installer
• Arctic Wolf: Arctic Wolf has recently observed the distribution of a trojanized RVTools installer via a malicious typosquatted domain.
• securityonline.info: Aidan Leon, cybersecurity practitioner and threat analyst at ZeroDay Labs, has disclosed a sophisticated supply chain attack involving
• Help Net Security: Malicious RVTools installer found on official site, researcher warns
• arcticwolf.com: RVTools Supply Chain Attack Delivers Bumblebee Malware
• www.helpnetsecurity.com: Malicious RVTools installer found on official site, researcher warns
• arcticwolf.com: RVTools Supply Chain Attack Delivers Bumblebee Malware
• The DefendOps Diaries: Understanding the RVTools Supply Chain Attack: Lessons and Prevention
• BleepingComputer: RVTools hit in supply chain attack to deliver Bumblebee malware
• bsky.app: The official website for the RVTools VMware management tool was taken offline in what appears to be a supply chain attack that distributed a trojanized installer to drop the Bumblebee malware loader on users' machines.
• www.bleepingcomputer.com: The official website for the RVTools VMware management tool was taken offline in what appears to be a supply chain attack where hackers replaced a DLL in the distributed installer to drop the Bumblebee malware loader on users' machines.
• hackread.com: RVTools installer on its official site was found delivering malware. Research shows it spread Bumblebee loader. Users urged to verify downloads.
• www.scworld.com: Widely used VMware environment reporting utility RVTools had its website compromised to facilitate the distribution of a trojanized installer that spreads the Bumblebee malware, reports The Hacker News.
• BleepingComputer: The official website for the RVTools VMware management tool was taken offline in what appears to be a supply chain attack where hackers replaced a DLL in the distributed installer to drop the Bumblebee malware loader on users' machines.

Classification:

• HashTags: #SupplyChain #Malware #RVTools
• Company: Robware
• Target: VMware Users
• Product: RVTools
• Feature: Supply Chain Attack
• Malware: Bumblebee
• Type: Malware
• Severity: Major