Loading story…
Security researchers and incident responders documented Bumblebee as a malware loader delivered through phishing campaigns that used hijacked email threads, spoofed senders, contact-form abuse, and links to legitimate file-sharing or cloud-hosted pages. Victims were lured into opening password-protected ZIP archives or mounting ISO/IMG files that contained a malicious Windows shortcut and DLL; the shortcut then launched rundll32.exe to execute the payload. Multiple reports tied the activity to TA578 and TA579, with researchers noting Bumblebee’s emergence as a likely successor to BazarLoader in access operations linked to Conti-associated ecosystems and follow-on delivery of Cobalt Strike.
Technical analysis showed Bumblebee using anti-analysis and anti-virtualization checks, RC4-encrypted configuration data, multi-server command-and-control, and in-memory loading techniques, while later reporting described continued development focused on EDR evasion and thread or APC-based injection. In one investigated intrusion, Bumblebee led to Meterpreter and Cobalt Strike deployment, reconnaissance with built-in Windows tools and AdFind, attempted LSASS dumping with ProcDump, lateral movement over RDP and SMB, creation of a sql_admin local administrator account, and installation of AnyDesk before responders contained the activity prior to ransomware deployment.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
23 events from the most recent confirmed update back to the earliest known activity.
The BOTCONF presentation states that Bumblebee resumed activity again in January 2023 after an earlier hiatus. The source uses this point to mark continued development and operational return.
The BOTCONF presentation indicates Bumblebee experienced a hiatus and later resumed activity in October 2022. The source presents this as a renewed phase in the malware's operational timeline.
Deep Instinct reported preventing a targeted spear-phishing attack against a client that delivered Bumblebee through a Smash file-sharing link to a malicious VHD containing an LNK shortcut and staged PowerShell loaders. The company assessed the tradecraft as consistent with EXOTIC LILY and published technical details and IOCs for the payload chain.
SANS analyzed an infection on 2022-05-18 in which abused TransferXL links delivered a ZIP archive containing an ISO with a LNK shortcut and hidden Bumblebee DLL executed via rundll32.exe. The compromised host then communicated with Bumblebee C2 infrastructure, generated HTTPS traffic to an Amazon EC2 host, and later showed Cobalt Strike traffic using the domain xenilik[.]com.
SANS compared two TA578 infection chains observed on 2022-05-09 in thread-hijacked emails: one using a storage.googleapis.com link to a fake document page and another using a password-protected ZIP attachment. Both chains delivered ISO files containing documents.lnk that executed rundll32.exe against a Bumblebee DLL named ramest.dll.
The DFIR Report states defenders contained and evicted the threat actor before ransomware deployment or other major impact. No further malicious activity was observed after eviction.
The DFIR Report says the actor used built-in Windows tools and AdFind for reconnaissance, moved laterally via RDP and SMB, created a local admin account named sql_admin, installed AnyDesk, and dumped LSASS with ProcDump. The actor also accessed cyber-insurance documents and password spreadsheets and later reached a backup server.
In the DFIR Report intrusion, BumbleBee contacted 154.56.0.221 and spawned processes that communicated with Meterpreter and Cobalt Strike infrastructure. The pivot from BumbleBee and Meterpreter to Cobalt Strike occurred about six hours after the initial BumbleBee execution.
The DFIR Report describes a May 2022 intrusion in which a user mounted an ISO file, executed documents.lnk, and launched BumbleBee via rundll32.exe tamirlan.dll,EdHVntqdWt. The report assesses the case with medium confidence as pre-ransomware activity.
Cynet reported that on April 12, 2022, the Bumblebee group was using IMG files in addition to ISO files. The report describes this as a change in delivery format within the campaign.
BleepingComputer reports that in April, Proofpoint detected another Bumblebee campaign that hijacked email threads and delivered archived ISO attachments in replies to targets. Proofpoint linked this activity to TA578's evolving delivery methods.
BleepingComputer says Proofpoint observed a DocuSign-themed campaign delivering a malicious ISO from Microsoft OneDrive and attributed it with high confidence to TA579. The same article places this activity in April.
The BOTCONF presentation states that Bumblebee was first publicly reported in March 2022. This marks the malware's first public disclosure in the source timeline.
BleepingComputer reports that in March, Proofpoint observed TA578 using contact-form messages claiming a site used stolen images and linking to an ISO file containing Bumblebee. Proofpoint attributed that campaign to TA578.
BleepingComputer states that in March, Google Threat Analysis Group reported Exotic Lily had started dropping Bumblebee instead of BazarLoader to deliver Cobalt Strike. Google linked Exotic Lily to initial access for Conti and Diavol ransomware operations.
BleepingComputer says researchers observed Bumblebee emerging in phishing campaigns in March, coinciding with a drop in BazarLoader use. The article describes this as the start of Bumblebee's visible operational use.
SANS reports that since February 2022, TA578 had been observed distributing both Bumblebee and IcedID. The article notes this overlap while comparing later TA578 delivery chains.
BleepingComputer reports that Proofpoint said BazaLoader had been absent from its data since February. The decline coincided with later Bumblebee activity replacing BazaLoader in delivery chains.
The BOTCONF presentation states that Bumblebee had its first build as a bot on 31 January 2022. The same source frames this as an early milestone in the malware's development timeline.
A BOTCONF presentation timeline begins with reporting on attacks exploiting CVE-2021-40444. This marks the earliest activity referenced in the source's Bumblebee development chronology.
OpenAnalysis documented unpacking a Bumblebee loader delivered in an ISO containing New Folder.Lnk and desk.dll, with the LNK invoking rundll32.exe desk.dll,aCmHmjrptS. The analysis recovered the payload from memory and revealed RC4-encrypted configuration strings, the hard-coded key "BLACK," and multiple C2 endpoints.
BleepingComputer reported researchers' assessment that Bumblebee was likely the latest development associated with the Conti syndicate and intended to replace BazarLoader. The article also said multiple threat actors previously tied to BazaLoader and IcedID had transitioned to Bumblebee.
Cynet described a campaign using spoofed identities and links to TransferXL, TransferNow, and WeTransfer to deliver ZIP archives containing malicious ISO or IMG files. The report also documented persistence, anti-VM checks, AdFind reconnaissance, and Bumblebee C2 traffic using the "bumblebee" user-agent.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
11 references tracked. Mallory keeps watching after this page renders.
securityintelligence.com
Open sourcesec-consult.com
Open sourcethedfirreport.com
Open sourcedeepinstinct.com
Open sourcebleepingcomputer.com
Open sourceelis531989.medium.com
Open sourcecynet.com
Open sourcebotconf.eu
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that the **Bumblebee** malware loader continues to evolve its initial access methods, moving beyond earlier PowerShell-heavy chains to newer delivery mechanisms including a JavaScript dropper and trojanized software installers. Deep Instinct said a new JavaScript-based dropper identified by its distinctive `PindOS` user-agent downloads DLL payloads from hardcoded URLs, stores them under `%appdata%/Microsoft/Templates/`, and launches them with `rundll32.exe`, while also supporting a PowerShell fallback path. The same dropper has been used to deliver both **Bumblebee** and **IcedID**, underscoring its role as a flexible malware distribution tool tied to ransomware-enabling intrusion activity. Other reporting shows Bumblebee has repeatedly changed infection chains while preserving its role as a loader for follow-on payloads such as **Cobalt Strike**, **Sliver**, **Meterpreter**, and ransomware. Earlier campaigns analyzed by Cyble used spam emails with password-protected attachments containing VHD files and malicious LNK shortcuts that triggered obfuscated PowerShell, Base64 decoding, gzip decompression, and reflective DLL injection via PowerSploit. VMRay found that once executed, Bumblebee uses packed or obfuscated binaries, extensive anti-analysis checks, and command-and-control over HTTP and later WebSockets to support shellcode injection, DLL injection, download-and-execute, persistence, shell execution, and plugin loading, highlighting a mature loader that is adapting both delivery and post-compromise tradecraft.
Aug 14, 2026
Researchers reported a new **Bumblebee** malware campaign that suggests the loader has resumed activity after Europol’s Operation Endgame disrupted Bumblebee and other major droppers. In the newly observed chain, victims are lured by phishing emails into opening a ZIP archive containing an LNK file that launches PowerShell, downloads an MSI installer, and executes it with `msiexec`. Instead of dropping a DLL to disk or spawning conspicuous child processes, the MSI abuses the Windows Installer **SelfReg** mechanism to load a DLL from an embedded CAB file and invoke `DllRegisterServer` directly in memory, a stealthier variation on Bumblebee delivery. The payload retained hallmark Bumblebee traits, including **RC4**-encrypted configuration data decrypted with the hardcoded key `NEW_BLACK`, port `443`, and campaign IDs `msi` and `lnk001`. Bumblebee emerged in 2022 as a widely used initial-access loader tied to actors such as **TA578** and **TA579**, commonly delivered through thread hijacking, contact-form abuse, ZIP or ISO archives, LNK files, and malicious DLL execution. Prior reporting linked the malware to follow-on deployment of **Cobalt Strike**, **Sliver**, **Meterpreter**, **IcedID**, and ransomware-associated operations connected to groups including **Conti**, **Diavol**, **LockBit**, and **AvosLocker**, underscoring that its return could restore a proven access path into enterprise networks.
Aug 15, 2026
Researchers detailed two malware loaders used to establish initial access and stage follow-on intrusions: **SquirrelWaffle**, which arrived through phishing documents and dropped VBS and PowerShell components before retrieving a packed 32-bit DLL, and **Bumblebee**, which was delivered through compromised open-source tools in an MSI installer containing a CAB archive. In the SquirrelWaffle chain, the DLL dropper unpacked shellcode using XOR/ROR logic and APLIB decompression, then loaded a payload exported as `ldr` that collected host data, decrypted embedded configuration, and extracted command-and-control IP addresses and domains. The malware communicated over standard `WS_32` socket APIs and downloaded **Cobalt Strike**, saving the binary with a `.txt` extension before execution. Analysis of Bumblebee showed a different but similarly stealthy execution path built around **DLL sideloading** and **DLL proxy forwarding**. The installer abused the legitimate Microsoft-signed `icardagt.exe` binary to load a malicious DLL that was renamed to `version.dll` at runtime, while anti-analysis features included junk code, timing checks, and possible virtual-machine detection through WMI queries. Investigators also observed failed file-creation attempts, a network connection to `19ak90ckxyjxc.life`, a temporary installation directory, and a Windows Installer `UserData` registry artifact, reinforcing that the MSI package orchestrated the full infection chain and positioned the malware for later hands-on-keyboard activity or ransomware deployment.
Jun 29, 2026