MITRE ATT&CKsoftware (malware)
S1039 Bumblebee
- Domain
- enterprise
- Platforms
- Windows
- Version
- 1.1
- Created
- 2022-08-19
Description
Bumblebee is a custom loader written in C++ that has been used by multiple threat actors, including possible initial access brokers, to download and execute additional payloads since at least March 2022. Bumblebee has been linked to ransomware operations including Conti, Quantum, and Mountlocker and derived its name from the appearance of "bumblebee" in the user-agent.
Related
Uses · MITRE ATT&CK (39)
- T1622 Debugger Evasion technique
- T1573.001 Symmetric Cryptography sub-technique
- T1132.001 Standard Encoding sub-technique
- T1204.001 Malicious Link sub-technique
- T1204.002 Malicious File sub-technique
- T1059.001 PowerShell sub-technique
- T1059.003 Windows Command Shell sub-technique
- T1059.005 Visual Basic sub-technique
- T1497.001 System Checks sub-technique
- T1497.003 Time Based Checks sub-technique
- T1566.001 Spearphishing Attachment sub-technique
- T1566.002 Spearphishing Link sub-technique
- T1518.001 Security Software Discovery sub-technique
- T1560 Archive Collected Data technique
- T1559.001 Component Object Model sub-technique
- T1036.005 Match Legitimate Resource Name or Location sub-technique
- T1070.004 File Deletion sub-technique
- T1548.002 Bypass User Account Control sub-technique
- T1218.008 Odbcconf sub-technique
- T1218.011 Rundll32 sub-technique
- T1055.001 Dynamic-link Library Injection sub-technique
- T1055.004 Asynchronous Procedure Call sub-technique
- T1053.005 Scheduled Task sub-technique
- T1497 Virtualization/Sandbox Evasion technique
- T1140 Deobfuscate/Decode Files or Information technique
- T1005 Data from Local System technique
- T1008 Fallback Channels technique
- T1012 Query Registry technique
- T1027 Obfuscated Files or Information technique
- T1033 System Owner/User Discovery technique
References
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bumblebee-loader-cybercrime Symantec Bumblebee June 2022
- https://www.proofpoint.com/us/blog/threat-insight/bumblebee-is-still-transforming Proofpoint Bumblebee April 2022
- https://blog.google/threat-analysis-group/exposing-initial-access-broker-ties-conti/ Google EXOTIC LILY March 2022