Loading malware…
Bumblebee is a Windows malware loader that emerged in 2022 and became a prominent access malware family used to establish footholds and deliver follow-on payloads in enterprise intrusions. It has been associated with initial-access activity linked to actors such as EXOTIC LILY, TA578, Storm-0249, and criminal ecosystems connected to Conti- and Trickbot-adjacent operations. Bumblebee has frequently been used as a precursor to post-compromise frameworks including Cobalt Strike, Brute Ratel, Sliver, and Meterpreter, and has been observed in intrusion chains that can culminate in ransomware deployment.
Bumblebee is typically delivered through socially engineered file-sharing or email-based campaigns, including spearphishing, thread hijacking, and lures involving disk-image containers such as ISO or VHD files. Observed delivery chains have used Windows shortcut files, PowerShell loaders, and rundll32-based execution of DLL payloads. Campaigns have abused legitimate file-sharing services and cloud-hosted landing pages to stage malicious archives and disk images.
Functionally, Bumblebee is designed to contact command-and-control infrastructure, register the infected host, and receive tasks for additional execution. Reported command capabilities include download-and-execute, shellcode injection, DLL injection, shell command execution, plugin loading, uninstall, and persistence establishment. It can generate host identifiers, collect basic system context such as the current username, and tailor follow-on payload selection to victim environment, with domain-joined enterprise systems more often receiving post-exploitation tooling while less connected systems may receive stealers or banking trojans.
The malware incorporates extensive anti-analysis and defense-evasion logic. Public analyses describe numerous checks for virtualization, sandbox artifacts, reverse-engineering tools, suspicious processes, hardware anomalies, and lack of user interaction. Bumblebee has also been reported to identify analytical tools by enumerating running processes, to use packed or crypter-protected payloads, and to employ custom packing and RC4-encrypted configuration data in many samples. Some variants can create a Visual Basic script for persistence and can bypass Windows User Account Control to deploy follow-on tools with elevated privileges.
Operationally, Bumblebee evolved rapidly during 2022 and 2023, including changes in delivery containers, command sets, network protocol usage, and evasion behavior. It has been closely associated with the Forest crypter and has also been disrupted as part of Operation Endgame. Within the cybercrime ecosystem, Bumblebee is best understood as a flexible enterprise-focused loader used by access brokers and malware distributors to bridge initial compromise and hands-on post-exploitation.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Tracking Bumblebee’s Development ... CrowdStrike Name: Shindig ... First reporting of Bumblebee ... Bumblebee Overview ... Loader / Main DLL Development ... C2 Communication Development
12 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
2022-05-18 (WEDNESDAY) ISC DIARY: EXOTIC LILY --> BUMBLEBEE --> COBALT STRIKE ... REFERENCE: This is the pcap and malware for an ISC diary on 2022-05-19: Bumblebee Malware from TransferXL URLs
TA578 also appears to be pushing ISO files for Bumblebee malware through thread-hijacked emails.
Cynet’s Threat Research and Intelligence team recently discovered a new malware campaign called BumbleBee. From our initial analysis, BumbleBee is a custom new loader that is used by different IAB groups.
Microsoft attributes this campaign to Storm-0249, an access broker active since 2021 and known for distributing, at minimum, BazaLoader, IcedID, Bumblebee, and Emotet malware.
A newly discovered malware loader called Bumblebee is likely the latest development of the Conti syndicate, designed to replace the BazarLoader backdoor used to deliver ransomware payloads.
Intel 471 researchers have noticed that the Conti group appears to have dropped BazarLoader in favor of a new malware called Bumblebee... Google stating that Bumblebee has been used by an access broker with ties to Conti.
36 distinct techniques documented for this family, organized by ATT&CK tactic.
The code then iterates through the array of Gzip compressed streams, decompresses them, and forms the 2nd stage code block which will then be executed by “Invoke-Expression.”
The file contained an .LNK (shortcut file), which executes a hidden PowerShell script that resides in the disk image file as well.
APT-C-36 has embedded a VBScript within a malicious Word document which is executed upon the document opening.
while the prevailing method is to embed the packed DLL directly inside another file (usually an ISO), during a short stint in June the malware’s operators experimented with using VHD files
Loader introduced with remote library injection ... Masquerades Bumblebee’s main DLL as a legitimate DLL | Typically used for process injection
Smoke Loader adds a Visual Basic script in the Startup folder to deploy the payload.
The content repeatedly describes malware and threat actors that 'bypass UAC,' 'perform UAC bypass,' or use specific Windows components such as fodhelper.exe, eventvwr.exe, sdclt.exe, CMSTPLUA COM interface, SilentCleanup, and registry hijacks to gain elevated privileges.
crypters, which are also referred to as loaders or packers, are applications designed to encrypt and obfuscate malware to evade detection by antivirus (AV) scanners and hinder analysis.
Crypters generally operate by encrypting the pre-compiled malware payload and embedding it within a secondary binary, which we refer to as a loader.
While some samples use no encryption at all, some use the RC4 algorithm to encrypt the configuration data.
The attackers registered a visually similar domain, using a lowercase “L” instead of a lowercase “I” ... created an email box impersonating an employee of the company.
Loader introduced with remote library injection ... Masquerades Bumblebee’s main DLL as a legitimate DLL | Typically used for process injection
The loader contains code to decrypt and execute the malicious payload
may also include additional sandbox-evasion or anti-analysis functions.
One of the techniques, for example, checks if certain files such as “System32\drivers\VBoxMouse.sys” exist on the system to detect the presence of VirtualBox based on its drivers.
The content repeatedly describes malware and threat actors collecting the username, identifying the current user, enumerating logged-on users, or running commands such as whoami, query user, and quser to determine user context on compromised systems.
Tasklist can be used to discover processes running on a system. Numerous malware families and threat groups are described as listing running processes, enumerating PIDs, checking for specific process names, or using APIs such as CreateToolhelp32Snapshot and commands such as tasklist and ps.
The content repeatedly describes malware and threat actors collecting host details such as hostname, OS version, architecture, CPU, memory, BIOS, language, and other machine characteristics; e.g., "Action RAT has the ability to collect the hostname, OS version, and OS architecture of an infected host."
BumbleBee checks whether certain user names reside in the victim’s machine by comparing against a hardcoded list of user names.
may also include additional sandbox-evasion or anti-analysis functions.
One of the techniques, for example, checks if certain files such as “System32\drivers\VBoxMouse.sys” exist on the system to detect the presence of VirtualBox based on its drivers.
I occasionally find Cobalt Strike from either Bumblebee or IcedID when testing samples in Active Directory (AD) environments.
671 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
200 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A sophisticated loader used by initial access brokers to gain an initial foothold, evade analysis and detection, contact C2 infrastructure, and download and execute second-stage payloads that can lead to ransomware deployment.
Threat actors abusing WebDAV is a common tactic, seen in past attacks delivering Bumblebee and Voldemort malware.
Bumblebee2
Loader delivered through a trojanized MSI using DLL side-loading to establish initial malware execution and connect to BumbleBee C2 infrastructure.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.