Powerful JavaScript Dropper PindOS Distributes Bumblebee and IcedID Malware
23-Jun-23
Next-stage payloads like Bumblebee and IcedID are being delivered through a brand-new type of JavaScript dropper, according to research. The malware is being tracked by the cybersecurity company Deep Instinct under the moniker PindOS since it has that name in its “User-Agent” string. Both Bumblebee and IcedID function as loaders, operating as a vector for other malware, including ransomware, on infected hosts.
In a recent analysis, Proofpoint emphasised IcedID’s decision to forego banking fraud capabilities in favour of a malware delivery-only strategy.Notably, Bumblebee is a replacement for another loader named BazarLoader, which has been linked to the TrickBot and Conti groups but is no longer active.
