Loading malware…
Bumblebee is a Windows malware loader that emerged in 2022 and became a prominent initial-access and malware-delivery platform in cybercrime operations. It has been associated with intrusion activity linked to actors such as EXOTIC LILY and TA578, and has been observed in campaigns that led to follow-on deployment of post-exploitation frameworks including Cobalt Strike and Brute Ratel. Reporting has also noted code and ecosystem relationships connecting Bumblebee to actors tied to TrickBot, Conti, Quantum, and possibly Ramnit-related development.
Bumblebee is typically delivered through socially engineered infection chains using phishing or spearphishing lures, often via legitimate file-sharing services or thread-hijacked email conversations. Observed delivery artifacts have included disk-image formats such as ISO and VHD, malicious shortcut files, OneNote documents, and PowerShell-based loaders. In multiple campaigns, user interaction with a mounted image or shortcut triggered execution of a Bumblebee DLL through native Windows utilities, after which the malware established command-and-control communications and awaited tasking.
Its primary role is to stage additional malicious capability on compromised hosts. Documented command support includes shellcode injection, DLL injection, download-and-execute, shell command execution, plugin loading, uninstall, and persistence establishment. Bumblebee has also been observed creating Visual Basic script-based persistence, identifying the current username, and performing extensive environment checks before or during execution. Anti-analysis and defense-evasion behavior is a defining characteristic: samples have checked for debuggers, malware-analysis tools, virtualization artifacts, sandbox indicators, hardware anomalies, and lack of user activity. Some variants can identify analytical tools by enumerating running processes, and the malware has been reported to bypass Windows User Account Control to deploy post-exploitation tooling with elevated privileges.
Bumblebee has evolved over time in both communications and internal protections. Early samples used HTTP for command-and-control, while later versions adopted WebSockets. Samples are frequently packed, encrypted, or obfuscated, and configuration data may be stored in plaintext or encrypted with RC4. Extracted configurations have included mission identifiers and command-and-control lists, enabling clustering of operational activity across campaigns. Research on sample clustering indicates that a small number of operators, and at times possibly a single dominant actor, accounted for much of the observed Bumblebee activity during parts of 2023.
The malware has figured prominently enough in the criminal ecosystem to be named among major droppers disrupted during Operation Endgame in 2024. Its operational significance stems from its role as a flexible loader used to convert phishing-driven access into broader compromise, credentialed post-exploitation, lateral movement tooling, and, in some cases, ransomware deployment.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Tracking Bumblebee’s Development ... CrowdStrike Name: Shindig ... First reporting of Bumblebee ... Bumblebee Overview ... Loader / Main DLL Development ... C2 Communication Development
12 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
2022-05-18 (WEDNESDAY) ISC DIARY: EXOTIC LILY --> BUMBLEBEE --> COBALT STRIKE ... REFERENCE: This is the pcap and malware for an ISC diary on 2022-05-19: Bumblebee Malware from TransferXL URLs
TA578 also appears to be pushing ISO files for Bumblebee malware through thread-hijacked emails.
Cynet’s Threat Research and Intelligence team recently discovered a new malware campaign called BumbleBee. From our initial analysis, BumbleBee is a custom new loader that is used by different IAB groups.
Microsoft attributes this campaign to Storm-0249, an access broker active since 2021 and known for distributing, at minimum, BazaLoader, IcedID, Bumblebee, and Emotet malware.
A newly discovered malware loader called Bumblebee is likely the latest development of the Conti syndicate, designed to replace the BazarLoader backdoor used to deliver ransomware payloads.
Intel 471 researchers have noticed that the Conti group appears to have dropped BazarLoader in favor of a new malware called Bumblebee... Google stating that Bumblebee has been used by an access broker with ties to Conti.
36 distinct techniques documented for this family, organized by ATT&CK tactic.
The code then iterates through the array of Gzip compressed streams, decompresses them, and forms the 2nd stage code block which will then be executed by “Invoke-Expression.”
The file contained an .LNK (shortcut file), which executes a hidden PowerShell script that resides in the disk image file as well.
APT-C-36 has embedded a VBScript within a malicious Word document which is executed upon the document opening.
while the prevailing method is to embed the packed DLL directly inside another file (usually an ISO), during a short stint in June the malware’s operators experimented with using VHD files
Loader introduced with remote library injection ... Masquerades Bumblebee’s main DLL as a legitimate DLL | Typically used for process injection
Smoke Loader adds a Visual Basic script in the Startup folder to deploy the payload.
The content repeatedly describes malware and threat actors that 'bypass UAC,' 'perform UAC bypass,' or use specific Windows components such as fodhelper.exe, eventvwr.exe, sdclt.exe, CMSTPLUA COM interface, SilentCleanup, and registry hijacks to gain elevated privileges.
crypters, which are also referred to as loaders or packers, are applications designed to encrypt and obfuscate malware to evade detection by antivirus (AV) scanners and hinder analysis.
Crypters generally operate by encrypting the pre-compiled malware payload and embedding it within a secondary binary, which we refer to as a loader.
While some samples use no encryption at all, some use the RC4 algorithm to encrypt the configuration data.
The attackers registered a visually similar domain, using a lowercase “L” instead of a lowercase “I” ... created an email box impersonating an employee of the company.
Loader introduced with remote library injection ... Masquerades Bumblebee’s main DLL as a legitimate DLL | Typically used for process injection
The loader contains code to decrypt and execute the malicious payload
may also include additional sandbox-evasion or anti-analysis functions.
One of the techniques, for example, checks if certain files such as “System32\drivers\VBoxMouse.sys” exist on the system to detect the presence of VirtualBox based on its drivers.
The content repeatedly describes malware and threat actors collecting the username, identifying the current user, enumerating logged-on users, or running commands such as whoami, query user, and quser to determine user context on compromised systems.
Tasklist can be used to discover processes running on a system. Numerous malware families and threat groups are described as listing running processes, enumerating PIDs, checking for specific process names, or using APIs such as CreateToolhelp32Snapshot and commands such as tasklist and ps.
The content repeatedly describes malware and threat actors collecting host details such as hostname, OS version, architecture, CPU, memory, BIOS, language, and other machine characteristics; e.g., "Action RAT has the ability to collect the hostname, OS version, and OS architecture of an infected host."
BumbleBee checks whether certain user names reside in the victim’s machine by comparing against a hardcoded list of user names.
may also include additional sandbox-evasion or anti-analysis functions.
One of the techniques, for example, checks if certain files such as “System32\drivers\VBoxMouse.sys” exist on the system to detect the presence of VirtualBox based on its drivers.
I occasionally find Cobalt Strike from either Bumblebee or IcedID when testing samples in Active Directory (AD) environments.
671 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
200 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A sophisticated loader used by initial access brokers to gain an initial foothold, evade analysis and detection, contact C2 infrastructure, and download and execute second-stage payloads that can lead to ransomware deployment.
Threat actors abusing WebDAV is a common tactic, seen in past attacks delivering Bumblebee and Voldemort malware.
Bumblebee2
Loader delivered through a trojanized MSI using DLL side-loading to establish initial malware execution and connect to BumbleBee C2 infrastructure.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.