RVTools Supply Chain Attack: Bumblebee Malware Delivered via Trusted VMware Utility

Aidan Leon, cybersecurity practitioner and threat analyst at ZeroDay Labs, has disclosed a sophisticated supply chain attack involving the trusted VMware utility, RVTools. The breach briefly transformed the popular IT management tool into a malware distribution vector, delivering a custom variant of the Bumblebee loader—a notorious payload frequently used in ransomware operations and initial access campaigns.

The incident was detected when Microsoft Defender for Endpoint flagged a suspicious behavior shortly after an employee attempted to install RVTools. As Leon describes: “Within moments of launching the installer, Defender flagged a suspicious file: version.dll, which was attempting to execute from within the same directory as the installer itself.”

This activity was immediately recognized as atypical for RVTools, prompting a deeper investigation.

A hash of the suspicious file was submitted to VirusTotal, where 33 out of 71 antivirus engines detected it as malicious. The malware was classified as a Bumblebee loader variant, known for its role in delivering post-exploitation frameworks like Cobalt Strike and facilitating ransomware deployment.

“The malware appeared to be a custom variation of the Bumblebee loader, which is known for being used in initial access scenarios by threat actors.”

Further metadata added a layer of surreal obfuscation, with entries like:

• Original File Name: Hydrarthrus
• Company: Enlargers pharmakos submatrix
• Product: nondimensioned yogis
• Description: elephanta ungroupable clyfaker gutturalness

Leon notes, “These surreal terms are deliberate obfuscation and an attempt at distraction… possibly to suggest a ‘god of crime’—though that remains speculative.”

The investigation confirmed that the compromised version of RVTools contained a version.dll not present in earlier clean versions. Notably, the RVTools website went offline shortly after the discovery and, upon returning, began serving a smaller, clean file whose hash matched the official version—strong evidence of a temporary compromise.

“It appeared to be a temporary and targeted supply chain compromise.”

ZeroDay Labs acted quickly to contain and neutralize the threat:

• Full Defender scans on the infected endpoint
• Quarantine of the malicious version.dll
• Verification of existing RVTools installations
• Submission of IOCs to internal detection teams
• Vendor notification

Related Posts:

• Bumblebee Loader Resurfaces with New Infection Chain
• Cyber Alert: Bumblebee Malware Targets US Organizations
• Akamai Unveils New VPN Post-Exploitation Techniques: Major Vulnerabilities Discovered in Ivanti and FortiGate VPNs
• Python Developers Targeted in Massive Supply Chain Attack; Over 170,000 Users Affected