Loading malware…
Bumblebee is a Windows malware loader first observed in 2022 that provides initial access and deploys additional payloads, including Meterpreter agents and Cobalt Strike Beacons. Its command set supports downloading and executing payloads, shellcode and DLL injection, shell-command execution, plugin loading, persistence, and uninstallation. It can establish persistence through Visual Basic scripts and scheduled tasks and bypass User Account Control to deploy post-exploitation tools with elevated privileges.
Distribution campaigns use phishing links and attachments, hijacked email threads, website contact-form messages, and legitimate file-sharing services. Common lures include business opportunities, invoices, and fabricated copyright complaints. Delivery chains frequently involve ZIP archives containing ISO, IMG, or VHD disk images, with Windows shortcuts initiating DLL execution or PowerShell-based loading. Bumblebee has also been delivered through OneNote documents, exploitation of WinRAR vulnerability CVE-2023-38831, and upstream malware such as Raspberry Robin. Known distributors include Exotic Lily, also tracked as TA580 and PROJECTOR LIBRA, and TA578.
Bumblebee employs packing, obfuscation, and extensive anti-analysis checks to identify debuggers, security tools, virtual machines, sandbox artifacts, atypical hardware, and absent user activity. It performs user, process, system, security-software, and registry discovery. Some variants encrypt configuration data with RC4 and include decoy command-and-control addresses. Its communications evolved from HTTP to WebSockets, and documented behaviors include encrypted command-and-control, data archiving, exfiltration over the command-and-control channel, and file deletion. Bumblebee-enabled intrusions have progressed to credential dumping, lateral movement, and domain compromise through subsequently deployed tools. Its infrastructure was targeted during Operation Endgame in May 2024.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
CVE-2023-38831, the WinRAR zero-day remote code execution vulnerability, has been exploited in the wild to distribute several malware families.
Tracking Bumblebee’s Development ... CrowdStrike Name: Shindig ... First reporting of Bumblebee ... Bumblebee Overview ... Loader / Main DLL Development ... C2 Communication Development
12 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Exotic Lily has been known to use Windows shortcuts to deploy the loader “BumbleBee”.
TA578 is a threat actor that has used contact forms and email to initiate communications with victims and to distribute malware including Latrodectus, IcedID, and Bumblebee.
Cynet’s Threat Research and Intelligence team recently discovered a new malware campaign called BumbleBee. From our initial analysis, BumbleBee is a custom new loader that is used by different IAB groups.
Microsoft attributes this campaign to Storm-0249, an access broker active since 2021 and known for distributing, at minimum, BazaLoader, IcedID, Bumblebee, and Emotet malware.
A newly discovered malware loader called Bumblebee is likely the latest development of the Conti syndicate, designed to replace the BazarLoader backdoor used to deliver ransomware payloads.
Intel 471 researchers have noticed that the Conti group appears to have dropped BazarLoader in favor of a new malware called Bumblebee... Google stating that Bumblebee has been used by an access broker with ties to Conti.
42 distinct techniques documented for this family, organized by ATT&CK tactic.
%windir%\system32\cmd.exe /c start rundll32.exe mkl2n.dll,kXlNkCKgFC
When a victim double-clicks on the PDF, the vulnerability will quietly launch a script in the folder to install malware on the device.
690 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
200 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Initial-access loader delivering secondary payloads through phishing and compromised websites. The article links its role to ransomware access and describes disruptions in 2024 and 2025.
A sophisticated loader used by initial access brokers to gain an initial foothold, evade analysis and detection, contact C2 infrastructure, and download and execute second-stage payloads that can lead to ransomware deployment.
Threat actors abusing WebDAV is a common tactic, seen in past attacks delivering Bumblebee and Voldemort malware.
Bumblebee2
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.