The Bumblebee malware loader resurfaces.

Summary

By the CyberWire staff

At a glance.

The Bumblebee malware loader resurfaces.
Ghostpulse malware delivered via PNG images.
Dental practice will pay $2.7 million over 2023 data breach.

The Bumblebee malware loader resurfaces.

Netskope warns that the Bumblebee malware loader has resurfaced with a new infection chain following a law enforcement disruption in May 2024. The malware is being distributed via phishing emails with malicious ZIP files: "The ZIP file contains an LNK file named 'Report-41952.lnk' that, once executed, starts a chain of events to download and execute the final Bumblebee payload in memory, avoiding the need to write the DLL on disk, as observed in previous campaigns." The researchers add, "The usage of LNK files is very common in Bumblebee campaigns, either to download the next stage payloads or to directly execute files. In this case, the file is used as a downloader and is responsible for downloading and executing the next stage of the infection chain."

Are You Confident in the Security of Your Remote and Hybrid Employees?

A remote or hybrid workforce expands your company's surface area of attack beyond corporate firewall boundaries. Employees’ personal computers introduce shadow IT, and home networks with default settings are easy targets, compounded by public Wi-Fi vulnerabilities. You need to develop a strategy to stay secure while remote employees work across untrusted networks. To learn how you can secure your company's workforce, get a free copy of the latest ThreatLocker® whitepaper on how to secure remote workforces.

Ghostpulse malware delivered via PNG images.

A new version of the Ghostpulse malware is being delivered via PNG image files, according to researchers at Elastic Security. The attackers use social engineering to trick victims into executing a PowerShell script that will download an image file that has the malware's configuration stored in its pixels.

The researchers explain, "The malware constructs a byte array by extracting each pixel's RED, GREEN, and BLUE (RGB) values sequentially using standard Windows APIs from the GdiPlus(GDI+) library. Once the byte array is built, the malware searches for the start of a structure that contains the encrypted GHOSTPULSE configuration, including the XOR key needed for decryption. It does this by looping through the byte array in 16-byte blocks. For each block, the first 4 bytes represent a CRC32 hash, and the next 12 bytes are the data to be hashed. The malware computes the CRC32 of the 12 bytes and checks if it matches the hash. If a match is found, it extracts the offset of the encrypted GHOSTPULSE configuration, its size, and the 4-byte XOR key, and then XOR decrypts it."

Save 30% on N2K Cyber & IT practice tests

In celebration of Cybersecurity Awareness Month, N2K is offering a 30% discount on all N2K practice tests with promo code "SECURE30". Choose from our vast exam prep library that includes top vendors like AWS, CompTIA, ISC2, Microsoft, and more. Get access to simulated exams, custom quizzes, e-flashcards, and more. Whether you're gearing up for a certification exam or looking to enhance your skills, now is the perfect time to invest in your cybersecurity journey. Visit n2k.com/certify to find your cert and save 30% with promo code “SECURE30” today.

Dental practice will pay $2.7 million over 2023 data breach.

Michigan-based Great Expression Dental Centers, a dental chain with 250 locations across nine states, has agreed to pay $2.7 million to settle a class-action lawsuit over a 2023 data breach, BankInfoSecurity reports. The breach affected more than 1.9 million patients and employees.

The company has also agreed to improve its data security practices, which will include "implementing multifactor authentication; updating a set of centralized information security protocols, including policies for the retention and destruction of patient information; implementing a vulnerability management tool for enterprise patching; implementing endpoint detection response protection; and ensuring all workstations are encrypted."

Notes.

Today's issue includes events affecting China, Russia, and the United States.

Attacks, Threats, and Vulnerabilities

Over 6,000 WordPress hacked to install plugins pushing infostealers (BleepingComputer) WordPress sites are being hacked to install malicious plugins that display fake software updates and errors to push information-stealing malware.

Fortinet issues private notifications to FortiManager customers to patch an undisclosed flaw (BeyondMachines) Fortinet released critical updates for FortiManager to fix a severe vulnerability reportedly being exploited by Chinese threat actors, with private notifications sent to select customers. While details remain undisclosed, the vulnerability may involve "Fortigate to FortiManager" connections, prompting mitigations like restricting device registrations to known serial numbers. Customers should promptly apply the patches and implement interim measures to secure their systems.

Marketplace

Sevco Security Hires Former Qualys VP of Engineering as CTO, Promotes Career SIEM Architect to Chief Architect (BusinessWire) Key personnel movements further spotlight Sevco as a leader in vulnerability management, providing aggregated, comprehensive visibility in a single platform for end-to-end exposure management programs.

Products, Services, and Solutions

7 ways we’re incorporating security by design into our products and services (Google) Today, Google published a white paper that shows how we’ve incorporated seven goals from our Secure by Design Pledge.

Torq and Defy Security Declare the Traditional VAR is Dead as They Partner to Transform Enterprise Cybersecurity Sales and Deployment Experience (BusinessWire) Cutting-edge cybersecurity companies join forces to empower SecOps teams to achieve long-term hyperautomation success and avoid scammy VAR hustles

Start Clean With AI: Select Safer LLM Models with Endor Labs (Endor Labs) You can now use Endor Labs to evaluate AI models on HuggingFace for security, popularity, quality, and activity.

How To Supercharge Your GRC with the RegScale 6.0 New Release (RegScale) Explore the RegScale 6.0 new release and learn about its updated features to reduce cost, 10x staff efficiency, simplify risk management, and more.

SailPoint Unveils New SailPoint Identity Security Cloud Capabilities, Previews Agentic AI Solution (BusinessWire) New functionality provides more automation, comprehensive visibility, and contextual insights to help deliver additional value and strengthen enterprise security

SailPoint Launches Privileged Task Automation Capability for Automating and Delegating the Execution of Privileged Tasks (BusinessWire) Privileged Task Automation revolutionizes the way organizations manage the execution of tasks that require privileged access

SailPoint Launches New Machine Identity Security Product to Help Simplify Management, Security, and Lifecycle of Machine Identities for Enterprises (BusinessWire) SailPoint is expanding beyond human identity governance into the rapidly growing field of machine identities, addressing a critical gap for enterprises

Legislation, Policy, and Regulation

Biden administration proposes new rules governing data transfers to adversarial nations (The Record) The Biden administration announced on Monday new proposed rules for regulating the transfer of certain data to adversarial countries such as China and Russia, creating specific requirements for how sensitive personal and federal information can be shared, if at all.

Industry Events

For a complete running list of events, please visit the Event Tracker.

Events

2024 CompTIA EMEA Member and Partner Conference (London, England, UK, Oct 21 - 22, 2024) Sync into the 2024 CompTIA EMEA Member and Partner Conference - connect with industry experts and your peers, whilst you gain insight into growth strategies and best practices for driving productivity and sales.

Pacific Hackers Conference (Mountain View, California, USA, Nov 2, 2024) Pacific Hacker Conference is an information security and hacking conference that gathers the brightest minds in cybersecurity and hacking from Silicon Valley and beyond. Focusing on cutting-edge techniques, research, and developments, we aim to create an environment where knowledge is shared and connections are made. Our audience ranges from security professionals, researchers, and ethical hackers to industry decision-makers. We keep the conference small, allowing us to provide what other Cons leave out.

SecureWorld Seattle (Bellevue, Washington, USA, Nov 6 - 7, 2024) Join your regional cybersecurity community for high-quality, affordable training and collaboration. Earn 12-18 CPE credits through 30+ educational sessions learning from local and nationally recognized industry leaders. Attend featured keynotes, panel discussions, breakout sessions, and solution vendor displays—all while networking with peers in InfoSec.

SecureWorld Midwest Virtual Conference (Virtual, Nov 13, 2024) Join with cybersecurity professionals for training and information sharing through an interactive online experience. Earn 6 CPE credits learning from nationally recognized industry leaders. The agenda offers 12+ educational presentations, including panel discussions, breakout sessions, and keynotes. Connect with your peers in the Networking Lounge, enter to win prizes, and see demos and resources from top solution vendors in the Exhibitor Hall.

CYBERSAT24 (Reston, Virginia, USA, Nov 18 - 20, 2024) CyberSat Summit has been at the forefront of the satellite industry’s burgeoning cybersecurity landscape since the event’s launch in 2017. Initially run as a single annual event, it morphed into two separate events in recent years – CyberLEO and CyberSatGov. This was done in response to changing market conditions, most notably the huge growth of LEO satellites and the corresponding rise of commercial interest in space. While CyberSatGov and CyberLEO were successful independently, the continued demand for LEO architectures and the ever-increasing collaboration between government and industry meant that these conversations needed to happen under one roof. As a result, 2024 will feature a single CyberSat event in November, where for the first time in its 7-year history, we will nearly double the event’s content offerings to include two concurrent tracks – one track titled “Space Infrastructure” and the second track titled “Space Data & Technology.” The “Space Infrastructure” track will continue CyberSat’s legacy focus on the overall satellite cybersecurity ecosystem and the protection of tangible assets like ground systems and satellite components, while the new “Space Data & Technology” track will focus on emerging technologies and the protection of space’s intangible assets like data. Keynotes, and a handful of general sessions, will contain talks that apply to all attendees.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.

Daily Briefing for 10.22.24

At a glance.

The Bumblebee malware loader resurfaces.

Ghostpulse malware delivered via PNG images.

Dental practice will pay $2.7 million over 2023 data breach.

Notes.

Attacks, Threats, and Vulnerabilities

Marketplace

Products, Services, and Solutions

Legislation, Policy, and Regulation

Events