Loading story…
Researchers reported that the Bumblebee malware loader continues to evolve its initial access methods, moving beyond earlier PowerShell-heavy chains to newer delivery mechanisms including a JavaScript dropper and trojanized software installers. Deep Instinct said a new JavaScript-based dropper identified by its distinctive PindOS user-agent downloads DLL payloads from hardcoded URLs, stores them under %appdata%/Microsoft/Templates/, and launches them with rundll32.exe, while also supporting a PowerShell fallback path. The same dropper has been used to deliver both Bumblebee and IcedID, underscoring its role as a flexible malware distribution tool tied to ransomware-enabling intrusion activity.
Other reporting shows Bumblebee has repeatedly changed infection chains while preserving its role as a loader for follow-on payloads such as Cobalt Strike, Sliver, Meterpreter, and ransomware. Earlier campaigns analyzed by Cyble used spam emails with password-protected attachments containing VHD files and malicious LNK shortcuts that triggered obfuscated PowerShell, Base64 decoding, gzip decompression, and reflective DLL injection via PowerSploit. VMRay found that once executed, Bumblebee uses packed or obfuscated binaries, extensive anti-analysis checks, and command-and-control over HTTP and later WebSockets to support shellcode injection, DLL injection, download-and-execute, persistence, shell execution, and plugin loading, highlighting a mature loader that is adapting both delivery and post-compromise tradecraft.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
10 events from the most recent confirmed update back to the earliest known activity.
VMRay reported that BumbleBee temporarily removed its evasion logic and later restored it around November 2022, marking a notable change in the malware's anti-analysis behavior.
VMRay reported that BumbleBee added the "plg" command around August 2022, further extending its command set for loading plugins from command-and-control infrastructure.
Cyble said the September 2022 payload behavior was similar to a Bumblebee variant the same researchers had analyzed in June 2022, indicating continuity in the malware's core functionality.
VMRay reported that BumbleBee added the "gdt" command around April 2022, expanding its command-and-control capabilities to execute shell commands on infected systems.
Deep Instinct stated that Bumblebee was first discovered in March 2022. The malware loader later became associated with Conti and used as a replacement for BazarLoader.
Deep Instinct noted that IcedID has been observed in the wild since at least 2017, establishing the malware family later delivered by the PindOS dropper.
VMRay analyzed BumbleBee's post-infection behavior, describing unpacking, command-and-control communications, and more than 50 evasion techniques. The report said older samples used HTTP while more recent versions adopted WebSockets and supported commands for injection, persistence, download-and-execute, uninstall, shell execution, and plugin loading.
Deep Instinct reported infection infrastructure used by the PindOS dropper, including multiple URLs for Bumblebee and IcedID payload delivery. The payloads were generated pseudo-randomly on demand to vary hashes and reduce signature-based detection.
Deep Instinct's Threat Research Lab identified a new JavaScript-based dropper distinguished by the "PindOS" user-agent string and Russian-language comments. The dropper was observed delivering both Bumblebee and IcedID via hardcoded URLs and rundll32-based execution.
Cyble Research & Intelligence Labs analyzed a Bumblebee campaign delivered through spam emails with password-protected VHD attachments containing a malicious LNK and PowerShell scripts. The chain used obfuscation, Base64 decoding, gzip decompression, and reflective PE injection to load the final Bumblebee DLL into powershell.exe.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
secureworks.com
Open sourcevmray.com
Open sourcedeepinstinct.com
Open sourceblog.cyble.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers and incident responders documented **Bumblebee** as a malware loader delivered through phishing campaigns that used hijacked email threads, spoofed senders, contact-form abuse, and links to legitimate file-sharing or cloud-hosted pages. Victims were lured into opening password-protected ZIP archives or mounting ISO/IMG files that contained a malicious Windows shortcut and DLL; the shortcut then launched `rundll32.exe` to execute the payload. Multiple reports tied the activity to **TA578** and **TA579**, with researchers noting Bumblebee’s emergence as a likely successor to **BazarLoader** in access operations linked to Conti-associated ecosystems and follow-on delivery of **Cobalt Strike**. Technical analysis showed Bumblebee using anti-analysis and anti-virtualization checks, RC4-encrypted configuration data, multi-server command-and-control, and in-memory loading techniques, while later reporting described continued development focused on EDR evasion and thread or APC-based injection. In one investigated intrusion, Bumblebee led to **Meterpreter** and **Cobalt Strike** deployment, reconnaissance with built-in Windows tools and **AdFind**, attempted **LSASS** dumping with **ProcDump**, lateral movement over **RDP** and **SMB**, creation of a `sql_admin` local administrator account, and installation of **AnyDesk** before responders contained the activity prior to ransomware deployment.
Aug 15, 2026
Researchers reported a new **Bumblebee** malware campaign that suggests the loader has resumed activity after Europol’s Operation Endgame disrupted Bumblebee and other major droppers. In the newly observed chain, victims are lured by phishing emails into opening a ZIP archive containing an LNK file that launches PowerShell, downloads an MSI installer, and executes it with `msiexec`. Instead of dropping a DLL to disk or spawning conspicuous child processes, the MSI abuses the Windows Installer **SelfReg** mechanism to load a DLL from an embedded CAB file and invoke `DllRegisterServer` directly in memory, a stealthier variation on Bumblebee delivery. The payload retained hallmark Bumblebee traits, including **RC4**-encrypted configuration data decrypted with the hardcoded key `NEW_BLACK`, port `443`, and campaign IDs `msi` and `lnk001`. Bumblebee emerged in 2022 as a widely used initial-access loader tied to actors such as **TA578** and **TA579**, commonly delivered through thread hijacking, contact-form abuse, ZIP or ISO archives, LNK files, and malicious DLL execution. Prior reporting linked the malware to follow-on deployment of **Cobalt Strike**, **Sliver**, **Meterpreter**, **IcedID**, and ransomware-associated operations connected to groups including **Conti**, **Diavol**, **LockBit**, and **AvosLocker**, underscoring that its return could restore a proven access path into enterprise networks.
Aug 15, 2026
Researchers detailed two malware loaders used to establish initial access and stage follow-on intrusions: **SquirrelWaffle**, which arrived through phishing documents and dropped VBS and PowerShell components before retrieving a packed 32-bit DLL, and **Bumblebee**, which was delivered through compromised open-source tools in an MSI installer containing a CAB archive. In the SquirrelWaffle chain, the DLL dropper unpacked shellcode using XOR/ROR logic and APLIB decompression, then loaded a payload exported as `ldr` that collected host data, decrypted embedded configuration, and extracted command-and-control IP addresses and domains. The malware communicated over standard `WS_32` socket APIs and downloaded **Cobalt Strike**, saving the binary with a `.txt` extension before execution. Analysis of Bumblebee showed a different but similarly stealthy execution path built around **DLL sideloading** and **DLL proxy forwarding**. The installer abused the legitimate Microsoft-signed `icardagt.exe` binary to load a malicious DLL that was renamed to `version.dll` at runtime, while anti-analysis features included junk code, timing checks, and possible virtual-machine detection through WMI queries. Investigators also observed failed file-creation attempts, a network connection to `19ak90ckxyjxc.life`, a temporary installation directory, and a Windows Installer `UserData` registry artifact, reinforcing that the MSI package orchestrated the full infection chain and positioned the malware for later hands-on-keyboard activity or ransomware deployment.
Jun 29, 2026