Data by Hatching Triage Windows

Bumblebee

Bumblebee is a Windows malware loader first observed in 2022 and primarily used to establish access and deliver follow-on payloads.

Profile source: Mallory

Bumblebee

Family profile

Bumblebee is a Windows malware loader first observed in 2022 and primarily used to establish access and deliver follow-on payloads. It has been distributed in phishing and thread-hijacking campaigns using malicious links or attachments, including disk-image files, archives, shortcut files, OneNote documents, and file-sharing-service lures. Observed distribution activity has been associated with TA578 and EXOTIC LILY. Bumblebee infections have been followed by post-exploitation tooling including Cobalt Strike and Brute Ratel, and may precede ransomware activity.

Bumblebee is commonly delivered as a DLL executed through legitimate Windows utilities. It uses packing, encryption, obfuscation, and extensive anti-analysis logic, including checks for virtualized environments, sandbox artifacts, analyst tools, hardware characteristics, and user activity. It can identify usernames, running processes, system and security software information, and registry data. Its command-and-control communications have evolved from HTTP to WebSockets and may use encrypted channels.

The loader supports download-and-execute operations, shell command execution, plugin loading, shellcode injection, DLL injection, persistence, and removal. It can create Visual Basic scripts for persistence and bypass User Account Control to deploy elevated post-exploitation tools. Bumblebee configurations may contain campaign mission identifiers, command-and-control entries including decoys, and RC4-encrypted configuration data. The malware has been frequently protected with the Forest crypter.

Capabilities

Defense Evasion
Exfiltration
Persistence
Post Exploitation
Privilege Escalation
Process Injection
Reconnaissance

C2 tracking

Seven-day C2 activity

Derp observations, rolling seven-day window

Sep 23

Observed infrastructure

Last seven days

First activity: Sep 23, 2026
Last activity: Sep 23, 2026
Feed role: C2
Host form: 24 IP / 0 hostnames

Leading locations

US13
PL4
DE2
MY2
CH1
GB1
SG1

Leading providers

FranTech Solutions3
HostPapa3
Artnet Sp. z o.o.2
DataWagon LLC2
Gigabit Hosting Sdn Bhd2
OVH SAS2

Infrastructure traits

Hosting 24

Samples

Recent associated samples

3932bed8386b68edf05549d6bdf60f80c876d86fe93d492016acfb93810398d9

Observed Sep 23, 2026Triage

9279dc8788b8b0d83aff3b6463e139bb56867c5e4954d11e6d02ba6f90b1cc14

Observed Sep 23, 2026Triage

Reported operators

Threat actors

12 named in public reporting

TA578

TA578 is a threat actor that has used contact forms and email to initiate communications with victims and to distribute malware including Latrodectus, IcedID, and Bumblebee.

EXOTIC LILY

2022-05-18 (WEDNESDAY) ISC DIARY: EXOTIC LILY --> BUMBLEBEE --> COBALT STRIKE ... REFERENCE: This is the pcap and malware for an ISC diary on 2022-05-19: Bumblebee Malware from TransferXL URLs

WIZARD SPIDER

Cynet’s Threat Research and Intelligence team recently discovered a new malware campaign called BumbleBee. From our initial analysis, BumbleBee is a custom new loader that is used by different IAB groups.

Storm-0249

Microsoft attributes this campaign to Storm-0249, an access broker active since 2021 and known for distributing, at minimum, BazaLoader, IcedID, Bumblebee, and Emotet malware.

TA579

A newly discovered malware loader called Bumblebee is likely the latest development of the Conti syndicate, designed to replace the BazarLoader backdoor used to deliver ransomware payloads.

Conti

Intel 471 researchers have noticed that the Conti group appears to have dropped BazarLoader in favor of a new malware called Bumblebee... Google stating that Bumblebee has been used by an access broker with ties to Conti.

Gamaredon Group

The noteable spike of campaigns involving malicious shortcuts (LNK files) conducted by both APT groups and advanced cybercriminals was detected in April-May this year – Bumblebee Loader and UAC-0010 (Armageddon) targeting EU Countries.

FIN11

Thus far, Raspberry Robin has been observed distributing payloads linked to FIN11, Clop Gang, BumbleBee, IcedID, and TrueBot on compromised networks.

xHunt

Actors issued these commands via a web shell we call BumbleBee that had been installed on the Exchange server, which we will discuss in detail in a future blog.

TA580

“TA580 used it to drop Bumblebee, why don’t we have a VHD chain?”

fin12

In this intrusion from April 2022, the threat actors used BumbleBee as the initial access vector. BumbleBee is a malware loader that was first reported by Google Threat Analysis Group in March 2022.

Storm 2561

Cyjax, highlighting the use of SEO poisoning to redirect users searching for software programs from companies like SonicWall, Hanwha Vision, and Pulse Secure (now Ivanti Secure Access) on Bing to fake sites and trick them into downloading MSI installers that deploy the Bumblebee loader.

Exploited software

Vulnerabilities linked to Bumblebee

1 CVEs

CVE-2021-40444 MSHTML Remote Code Execution Vulnerability

MITRE ATT&CK

Bumblebee in ATT&CK

119 distinct techniques

Techniques

119 techniques

T1055 Process Injection T1027 Obfuscated Files or Information T1027.002 Software Packing T1497 Virtualization/Sandbox Evasion T1140 Deobfuscate/Decode Files or Information T1518.001 Security Software Discovery T1059.005 Visual Basic T1057 Process Discovery T1568.002 Domain Generation Algorithms T1082 System Information Discovery T1548.002 Bypass User Account Control T1547.001 Registry Run Keys / Startup Folder T1033 System Owner/User Discovery T1071 Application Layer Protocol T1566.001 Spearphishing Attachment T1497.001 System Checks T1547 Boot or Logon Autostart Execution T1560 Archive Collected Data T1586.002 Email Accounts T1497.002 User Activity Based Checks T1218.011 Rundll32 T1055.001 Dynamic-link Library Injection T1204.002 Malicious File T1027.013 Encrypted/Encoded File T1036 Masquerading T1566.002 Spearphishing Link T1059.001 PowerShell T1105 Ingress Tool Transfer T1059 Command and Scripting Interpreter T1620 Reflective Code Loading T1204.001 Malicious Link T1566 Phishing T1548.003 Sudo and Sudo Caching T1496 Resource Hijacking T1204 User Execution T1087 Account Discovery T1056.001 Keylogging T1552 Unsecured Credentials T1059.003 Windows Command Shell T1018 Remote System Discovery T1037.001 Logon Script (Windows) T1070.004 File Deletion T1132.001 Standard Encoding T1547.009 Shortcut Modification T1047 Windows Management Instrumentation T1587.001 Malware T1012 Query Registry T1583 Acquire Infrastructure T1055.004 Asynchronous Procedure Call T1021 Remote Services T1053.005 Scheduled Task T1071.001 Web Protocols T1480.001 Environmental Keying T1564.001 Hidden Files and Directories T1560.001 Archive via Utility T1016 System Network Configuration Discovery T1573.001 Symmetric Cryptography T1592 Gather Victim Host Information T1053 Scheduled Task/Job T1090 Proxy T1055.003 Thread Execution Hijacking T1129 Shared Modules T1559.001 Component Object Model T1059.007 JavaScript T1218.007 Msiexec T1553.005 Mark-of-the-Web Bypass T1573 Encrypted Channel T1001 Data Obfuscation T1586.001 Social Media Accounts T1218.001 Compiled HTML File T1218 System Binary Proxy Execution T1518 Software Discovery T1574.006 Dynamic Linker Hijacking T1562 Impair Defenses T1027.006 HTML Smuggling T1574 Hijack Execution Flow T1566.003 Spearphishing via Service T1562.001 Disable or Modify Tools T1505.003 Web Shell T1106 Native API T1134 Access Token Manipulation T1055.012 Process Hollowing T1548 Abuse Elevation Control Mechanism T1090.003 Multi-hop Proxy T1543 Create or Modify System Process T1195 Supply Chain Compromise T1574.001 DLL T1189 Drive-by Compromise T1071.004 DNS T1608.006 SEO Poisoning T1568 Dynamic Resolution T1622 Debugger Evasion T1112 Modify Registry T1027.007 Dynamic API Resolution T1586 Compromise Accounts T1132 Data Encoding T1005 Data from Local System T1041 Exfiltration Over C2 Channel T1036.005 Match Legitimate Resource Name or Location T1003 OS Credential Dumping T1572 Protocol Tunneling T1213 Data from Information Repositories T1021.002 SMB/Windows Admin Shares T1124 System Time Discovery T1083 File and Directory Discovery T1003.001 LSASS Memory T1570 Lateral Tool Transfer T1135 Network Share Discovery T1021.001 Remote Desktop Protocol T1046 Network Service Discovery T1553.002 Code Signing T1569.002 Service Execution T1583.001 Domains T1588.003 Code Signing Certificates T1614.001 System Language Discovery T1555 Credentials from Password Stores T1008 Fallback Channels T1102 Web Service T1497.003 Time Based Checks

Reporting

Research mentioning Bumblebee

Jul 30

Splunk Research

Detection: Windows Suspicious Child Process of Consent.EXE | Splunk Security Content

Splunk published a Windows endpoint analytic that detects suspicious child processes launched by consent.exe, a behavior strongly associated with User Account Control (UAC) bypass and privilege escalation. Because consent.exe normally displays the UAC elevation prompt rather than spawning executables, the detection treats such process creation as anomalous, excluding WerFault.exe as a known crash-related exception. The analytic maps to MITRE ATT&CK techniques T1548.002, T1068, and T1059, and is designed for telemetry from Sysmon, Windows Security Event ID 4688, and CrowdStrike ProcessRollup2 data normalized into Splunk's Endpoint data model. The release aligns with MITRE ATT&CK documentation showing UAC bypass remains a widely used post-compromise technique across ransomware operators, commodity malware, and state-linked intrusion groups. ATT&CK lists methods including COM abuse through CMSTPLUA, scheduled task abuse such as SilentCleanup, registry hijacks involving ms-settings and mscfile, and abuse of trusted Windows binaries including fodhelper.exe, eventvwr.exe, and sdclt.exe. Splunk also published supporting attack simulation data for suspicious child processes of consent.exe, giving defenders a way to test visibility for this privilege-escalation pattern, although the analytic is disabled by default and generates intermediate risk events rather than direct notable alerts.

Jul 24

Security Online Info

ACR Stealer Spreads Through ClickFix Lures

Microsoft reported a rise in ACR Stealer intrusions across customer environments, tracing two prominent infection chains that relied on ClickFix social engineering to trick users into launching malicious commands. In one chain, attackers delivered DLLs over WebDAV, then used obfuscated PowerShell, Python-based loaders, and scheduled tasks for persistence; some infections also resolved command-and-control infrastructure through blockchain-based dead-drop techniques such as EtherHiding. A second chain used mshta.exe, VBScript, and obfuscated PowerShell before retrieving payloads hidden inside a hosted JPEG and executing them filelessly in memory. The campaigns were designed to steal browser credentials, cookies, authentication tokens, and sensitive enterprise documents, including PDFs and Microsoft 365-related files. Microsoft said the malware abuses DPAPI to decrypt browser data and stages the collected information for exfiltration. The company published indicators of compromise, MITRE ATT&CK mappings, hunting queries, and mitigation guidance focused on detecting ClickFix lures, suspicious WebDAV or MSHTA activity, obfuscated PowerShell, persistence mechanisms, and browser credential theft.

Jul 22

Splunk Research