Red Canary on Twitter: "The #BumbleBee dropper/downloader continues to change. We’re now seeing odbcconf.exe load the malicious DLL (rather than Rundll32). While odbcconf.exe can execute DLL files, we don’t commonly observe it doing so in the wild, so this is an interesting change! #RCIntel https://t.co/oXtXAu77V8" / Twitter
https://twitter.com/redcanary/status/1541838407894171650