Loading malware…
BumbleBee is a Windows malware loader used to establish initial access and deliver follow-on payloads in criminal intrusion chains. It has been associated with campaigns that distribute trojanized software installers, including MSI packages, and execute through DLL side-loading using legitimate signed binaries. Observed delivery methods include SEO poisoning that lures victims searching for enterprise IT tools to fake download sites, as well as phishing and malicious shortcut-based staging in some reporting. BumbleBee has also been linked to broader loader ecosystems targeted by international law-enforcement disruption efforts.
The malware is modular and designed to fetch or launch additional payloads after execution. Reported behavior includes command-and-control communications using domain generation techniques, anti-analysis checks that inspect running processes and analytical tooling, Windows Registry checks, geofencing, and stealth-oriented execution methods. BumbleBee has been observed using DLL side-loading for execution and process injection, including APC-based injection techniques, to run payloads in memory and reduce static detection opportunities.
In enterprise intrusions, BumbleBee has been used as the first-stage access mechanism preceding deployment of tools such as AdaptixC2 and, later, ransomware including Akira. Post-compromise activity seen after BumbleBee infections has included reconnaissance, credential theft, persistence through remote administration tooling, lateral movement via remote access protocols, and large-scale data exfiltration by the operators. The malware has been observed in campaigns targeting organizations through fake installers for administrative and network-management software, indicating a focus on gaining execution by privileged IT users. BumbleBee is widely tracked as a prominent contemporary loader in the cybercrime ecosystem.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
9 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Starting in March 2022, Proofpoint observed campaigns delivering a new downloader called Bumblebee. ... Bumblebee's objective is to download and execute additional payloads. Proofpoint researchers observed Bumblebee dropping Cobalt Strike, shellcode, Sliver and Meterpreter.
Starting in March 2022, Proofpoint observed campaigns delivering a new downloader called Bumblebee. ... Bumblebee's objective is to download and execute additional payloads. Proofpoint researchers observed Bumblebee dropping Cobalt Strike, shellcode, Sliver and Meterpreter.
This investigation resulted in the discovery of two new backdoors called TriFive and Snugy, which we discussed in a prior blog, as well as a new webshell that we call BumbleBee... The actor used the BumbleBee webshell to upload and download files to and from the compromised Exchange server, but more importantly, to run commands that the actor used to discover additional systems and to move laterally to other servers on the network.
“TA580 used it to drop Bumblebee, why don’t we have a VHD chain?”
Microsoft attributes this campaign to Storm-0249... known for distributing, at minimum, BazaLoader, IcedID, Bumblebee, and Emotet malware.
"...a supply chain attack that distributed a trojanized installer to drop the Bumblebee malware loader on users' machines."
28 distinct techniques documented for this family, organized by ATT&CK tactic.
The threat actor then initiated internal reconnaissance using built-in Windows utilities, including systeminfo, nltest /dclist:, whoami /groups, and net group domain admins /dom.
it pointed to ‘cmd’, specifically initiating a file download from the web.
I also identified the sample creating a registry key under: ‘HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S****\Products\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1–5–18\Products\CBE574DD169D4FA4BBA8EB19AF497275’
The attack used this binary for process injection: the loader executed the masqueraded WAB.exe and injected it with Adaptix shellcode.
Bumblebee’s injection module ( dij command for DLL Injection) dynamically resolves NtQueueApcThread at runtime and uses it to inject a payload DLL into a hardcoded list of target process
Attackers spawn a process suspended, queue an APC into its main thread before the AV/EDR’s user-mode hooks have loaded, then resume. The payload runs before the security product begins. | Hence APC injection was formed as a technique, they’d find a process with a thread in an alertable wait and get a handle to it, call VirtualAllocEx and WriteProcessMemory to plant shellcode and then call QueueUserAPC pointed at the shellcode, the thread would eventually wake up and execute the shellcode.
It spreads through phishing emails and compromised software, evading detection with advanced obfuscation techniques.
While looking through the IAT of our sample I noticed something unusual, calls to certain APIs had an extremely high count, for example ‘AddAtomA’.
AdgNsy.exe (instance renommée de WAB.exe) ... win.exe ... ManageEngine_OpManager_64bit.exe (leurre légitime)
The attack used this binary for process injection: the loader executed the masqueraded WAB.exe and injected it with Adaptix shellcode.
Bumblebee’s injection module ( dij command for DLL Injection) dynamically resolves NtQueueApcThread at runtime and uses it to inject a payload DLL into a hardcoded list of target process
Attackers spawn a process suspended, queue an APC into its main thread before the AV/EDR’s user-mode hooks have loaded, then resume. The payload runs before the security product begins. | Hence APC injection was formed as a technique, they’d find a process with a thread in an alertable wait and get a handle to it, call VirtualAllocEx and WriteProcessMemory to plant shellcode and then call QueueUserAPC pointed at the shellcode, the thread would eventually wake up and execute the shellcode.
We then came across several calls to MultiByteToWideChar, after a number of hits on this breakpoint we observed the string ‘Select * From Win32_ComputerSystemProduct’ — this command line will gather all the information about the current system, and is another possible VM detection/anti analysis technique embedded in the program.
I also identified the sample creating a registry key under: ‘HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S****\Products\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1–5–18\Products\CBE574DD169D4FA4BBA8EB19AF497275’
The content repeatedly describes malware and threat actors querying, enumerating, opening, and reading Windows Registry keys and values, e.g., "APT41 queried registry values to determine items such as configured RDP ports and network configurations" and "Reg may be used to gather details from the Windows Registry of a local or remote system at the command-line interface."
The content is a long ATT&CK-style listing of malware and threat actors that collect host details such as OS version, hostname, architecture, CPU, memory, BIOS, language, and other basic system characteristics; examples include use of commands like systeminfo, ver, uname, sw_vers, and WMI queries.
We then came across several calls to MultiByteToWideChar, after a number of hits on this breakpoint we observed the string ‘Select * From Win32_ComputerSystemProduct’ — this command line will gather all the information about the current system, and is another possible VM detection/anti analysis technique embedded in the program.
The Bumblebee malware established command and control (C2) with 109.205.195[.]211:443 and 188.40.187[.]145:443 using DGA domains. Approximately five hours after this initial execution, Bumblebee deployed an AdaptixC2 beacon... which established a new C2 channel to 172.96.137[.]160:443.
This resulted in an active Adaptix C2 HTTP beacon ... The AdaptixC2 beacon ... maintained persistent command-and-control (C2) communication with 172.96.137[.]160 throughout the intrusion.
Using Wireshark to capture DNS requests and C2 Traffic... I developed a Python script to extract all DNS requests
I noticed a straightforward request to download a .bat file from the attacker’s server... The analysis indicates a clear attempt to fetch a new stage utilizing the curl command
386 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
167 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Threat actors abusing WebDAV is a common tactic, seen in past attacks delivering Bumblebee and Voldemort malware.
Bumblebee2
Loader delivered through a trojanized MSI using DLL side-loading to establish initial malware execution and connect to BumbleBee C2 infrastructure.
A first-stage loader delivered via a trojanized ManageEngine OpManager MSI. It was disguised as msimg32.dll and executed through DLL side-loading using consent.exe, then dropped a second-stage payload that enabled persistent access and follow-on intrusion activity.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.