Bumblebee Returns: The Voicemail VBA Macro

An accounts-payable workstation tripped an Office-child-process rule this morning. Before you chase artifacts, read the situation: a voicemail-notification email landed in the mailbox, a document was pulled from a cloud share, and a script interpreter ran out of a word processor. Orient yourself to the timeline, then move on to the evidence.

The intrusion starts in the mailbox. One inbound message posed as a voicemail notification, failed sender authentication, and steered the recipient to an external file share rather than carrying an attachment. Establish who sent it.

Following the link did not compromise anything on its own. The recipient downloaded a file from the share and opened it, and that file is where execution began. Name the document that was pulled down and opened.

Opening the document did not run the payload directly. The macro reached for a trusted scripting tool to do the work, and that parent-child relationship is the clearest sign of compromise on the host. Identify the interpreter the document spawned.

After the script ran, execution was proxied through signed system binaries to run attacker code from the user profile. Recover the library that was ultimately loaded.

Once the loader was running it reached out to attacker infrastructure to take orders. To contain the host and block the channel, identify the command-and-control host it beaconed to over TLS.

For the report, classify how the attacker ran the loader through a signed Windows installer binary to evade controls that watch for unknown executables. Map that behavior to its MITRE ATT&CK technique.