RVTools Supply Chain Attack Delivers Bumblebee Malware Loader

The official website for RVTools, a widely used VMware management utility, was compromised in a supply chain attack between May 12-19, 2025. Attackers replaced a legitimate installer component with a malicious DLL that deployed the Bumblebee malware loader – a tool historically linked to the Conti ransomware group. The trojanized installer remained active for approximately one hour before detection and mitigation efforts began¹.

Attack Vector and Technical Analysis

The attackers modified the RVTools installer to include a malicious version.dll file that leveraged DLL search order hijacking. When executed, this component sideloaded the Bumblebee payload with elevated privileges. Forensic analysis revealed several anomalies in the compromised installer: a 60% larger file size (~40MB vs legitimate ~25MB), mismatched SHA-256 hashes, and obfuscated metadata containing unusual descriptors like “Hydrarthrus” and “elephanta ungroupable”².

Microsoft Defender for Endpoint flagged the execution chain due to abnormal behavior patterns. VirusTotal detection rates showed 33 out of 71 antivirus engines identified the malicious file. The attackers also registered typosquatted domains (e.g., rvtools.org) as alternate distribution channels³.

Infection Mechanism and Impact

The malware established persistence through C2 communication with servers at 185.143.223.47 and 91.234.19.162, capable of delivering secondary payloads including Cobalt Strike beacons or ransomware. A related incident involving Procolored printer software demonstrated the attackers’ capability, where similar techniques stole $974,000 in Bitcoin (wallet: 1BQZKqdp2CV3QV5nUEsqSg1ygegLmqRygj)⁴.

The attack posed particular risk to VMware environments due to RVTools’ widespread enterprise adoption for virtual infrastructure management. Successful infections could provide attackers with privileged access to virtualization management systems.

Mitigation and Detection

Robware, the vendor behind RVTools, restored legitimate files after discovering the compromise. Security teams should verify installer integrity using the known-good SHA-256 hash: 27282e66e73fb247ba92a91f500b52d641549a8388e35155938b0d2da3abd537. Monitoring for version.dll in user directories and network traffic to the identified C2 IPs is recommended⁵.

Enterprise defenders should audit any RVTools downloads during the compromise window and consider implementing DLL whitelisting policies. The incident highlights the need for code signing verification and HTTPS-only downloads for management tools.

Indicators of Compromise

Type	Value
SHA-256	27282e66e73fb247ba92a91f500b52d641549a8388e35155938b0d2da3abd537
Domains	rvtools.org, robware.net
IPs	185.143.223.47, 91.234.19.162
Wallet	1BQZKqdp2CV3QV5nUEsqSg1ygegLmqRygj

This incident follows a pattern of software supply chain attacks targeting IT management tools. The use of Bumblebee suggests possible connections to ransomware operations, though no encryption payloads were observed in this campaign. Organizations should review their software update verification processes and consider enhanced monitoring for DLL sideloading techniques.