Cybersecurity researchers have discovered a novel variant of the ELF (Executable and Link format) malware Bifrose (AKA Bifrost) which is using a typosquat domain mimicking VMware to evade detection. Bifrost is a Remote Access Trojan (RAT) that allows attackers to gather sensitive information on an infected host which is relayed back to the attacker via Command and Control (C2). Bifrost was originally a Windows malware first seen around 2004 and leveraged by the hacking group BlackTech. The Linux version of the malware has been observed since at least 2020. Its capabilities include launching remote shells, downloading/uploading files, and performing file operations. This new variant of Bifrost is noteworthy because it reportedly uses a typosquat of a VMware domain to make it harder for defenders to detect C2 activities. Researchers analyzed the malware and observed it reaching out to “download[.]vmfare[.]com”, which was resolved by a Taiwan-based public DNS (Domain Name System) resolver. As of the writing of this article 11/92 security vendors tracked by VirusTotal have flagged the “download[.]vmfare[.]com” subdomain as malicious while zero (0) security vendors have flagged the “vmfare[.]com” domain as malicious. Researchers also discovered that the malicious IP address associated with the malware hosted an ARM (Advanced RISC Machine) version of Bifrost. The difference between the x86 and ARM versions is in the type of computer processor the malware is developed to run on. This indicates that attackers are seeking to expand their attack surface as more devices are built on ARM processors. CTIX analysts recommend that organizations block the abused VMware typosquat domain at their firewalls. CTIX analysts will continue to report on new and expanding malware strains and capabilities.