LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S1039: Bumblebee

MITRE ATT&CK S1039: Bumblebee Malware details for Windows, with detection guidance, relationships and mapped CVEs.

EnterpriseS1039MalwareObject v1.1Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

Bumblebee matters because ATT&CK describes it as a Windows C++ loader used to download and execute additional payloads, with links in reporting to ransomware operations and possible initial access broker activity. For leaders, the practical issue is not the loader name itself, but whether the organization can quickly prove which Windows hosts executed suspicious loaders, what follow-on payloads were fetched, what data may have been collected or exfiltrated, and whether ransomware-prevention controls would interrupt the chain.

Executive priority

Treat this as a validation case for ransomware readiness and incident triage on Windows endpoints. Ask whether SOC and IR teams can correlate endpoint execution, persistence, process injection, PowerShell/cmd/WMI use, scheduled tasks, registry queries, outbound web/C2 traffic, downloaded tools, file deletion, and potential data exfiltration into a single investigation timeline. This supports business continuity planning, audit evidence for endpoint monitoring, and prioritization of controls that reduce loader-to-ransomware escalation risk.

Technical view

ATT&CK provides no dedicated detection text for Bumblebee, so defenders should build coverage from the related behaviors: execution via PowerShell, Windows Command Shell, Visual Basic, WMI, Native API, and shared modules; persistence/execution through Scheduled Task; evasion through obfuscation, masquerading, process injection, DLL injection, APC injection, and file deletion; discovery through registry, process, user, and system information queries; and command-and-control through fallback channels, web services, ingress tool transfer, standard encoding, and exfiltration over C2. Because the malware object is Windows-scoped, prioritize Windows endpoint, identity, and network telemetry while avoiding assumptions about guaranteed detection from any single signal.

Likely telemetry

  • Windows endpoint process creation and command-line logs
  • PowerShell script block/module/transcription logs where enabled
  • WMI activity and remote/local execution telemetry
  • Scheduled task creation, modification, and execution events
  • Windows Registry query and modification telemetry

Detection direction

  • Validate correlation across loader-like execution followed by discovery, persistence, C2, tool transfer, and file deletion rather than relying on a single Bumblebee indicator.
  • Tune detections for suspicious use of PowerShell, cmd, WMI, scheduled tasks, and registry queries in user workstations where administrative or automation activity is uncommon.
  • Review process injection, DLL injection, APC injection, and unusual module-loading alerts with parent/child process context to reduce false positives from legitimate security and management tools.
  • Inspect outbound web service usage, fallback-channel behavior, encoded traffic, and downloads from Windows hosts, accounting for high noise from normal web and cloud-service traffic.
  • Ensure IR playbooks preserve volatile endpoint and network evidence because file deletion and obfuscation can reduce post-incident visibility.

Mitigation priorities

  • Prioritize endpoint hardening and monitoring on Windows systems, especially script interpreters, WMI, scheduled tasks, and unauthorized module execution.
  • Restrict and monitor administrative scripting and remote management paths with least privilege and strong identity controls.
  • Apply application control or allow-listing where operationally feasible to reduce unauthorized loaders, scripts, and shared-module execution.
  • Improve egress governance with proxy/DNS logging and policy controls so unusual web-service C2, fallback channels, and tool downloads are reviewable and containable.
  • Maintain ransomware-oriented IR readiness: rapid host isolation, payload scoping, credential review, backup validation, and evidence preservation.
Additional notes and limits

The most useful defensive framing is loader behavior leading to follow-on payload execution. ATT&CK links Bumblebee to multiple techniques across execution, discovery, evasion, command-and-control, collection, and exfiltration, and notes reporting associations with ransomware operations and possible initial access broker use. Those relationships justify prioritizing it for ransomware-readiness validation, but local telemetry is required to determine exposure or incident impact.

Official ATT&CK detection guidance is not provided for this object, tactics are not specified on the malware object itself, and no aliases or labels are supplied. Platform support for the malware object is Windows; some related techniques list broader platforms, but that should not be treated as Bumblebee platform coverage. The supplied data does not prove current activity, attribution, exploitation against any organization, or guaranteed detection by any control.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Bumblebee

No official description is available in the imported ATT&CK source object.

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

39 rows
DomainIDNameRelationship / procedure
EnterpriseT1082System Information DiscoveryThis object uses System Information Discovery.
EnterpriseT1033System Owner/User DiscoveryThis object uses System Owner/User Discovery.
EnterpriseT1047Windows Management InstrumentationThis object uses Windows Management Instrumentation.
EnterpriseT1041Exfiltration Over C2 ChannelThis object uses Exfiltration Over C2 Channel.
EnterpriseT1059.003Windows Command ShellSub-techniqueThis object uses Windows Command Shell.
EnterpriseT1497.001System ChecksSub-techniqueThis object uses System Checks.
EnterpriseT1140Deobfuscate/Decode Files or InformationThis object uses Deobfuscate/Decode Files or Information.
EnterpriseT1055.001Dynamic-link Library InjectionSub-techniqueThis object uses Dynamic-link Library Injection.
EnterpriseT1560Archive Collected DataThis object uses Archive Collected Data.
EnterpriseT1497.003Time Based ChecksSub-techniqueThis object uses Time Based Checks.
EnterpriseT1218.008OdbcconfSub-techniqueThis object uses Odbcconf.
EnterpriseT1005Data from Local SystemThis object uses Data from Local System.
EnterpriseT1518.001Security Software DiscoverySub-techniqueThis object uses Security Software Discovery.
EnterpriseT1055.004Asynchronous Procedure CallSub-techniqueThis object uses Asynchronous Procedure Call.
EnterpriseT1059.005Visual BasicSub-techniqueThis object uses Visual Basic.
EnterpriseT1102Web ServiceThis object uses Web Service.
EnterpriseT1497Virtualization/Sandbox EvasionThis object uses Virtualization/Sandbox Evasion.
EnterpriseT1105Ingress Tool TransferThis object uses Ingress Tool Transfer.
EnterpriseT1008Fallback ChannelsThis object uses Fallback Channels.
EnterpriseT1566.002Spearphishing LinkSub-techniqueThis object uses Spearphishing Link.
EnterpriseT1132.001Standard EncodingSub-techniqueThis object uses Standard Encoding.
EnterpriseT1218.011Rundll32Sub-techniqueThis object uses Rundll32.
EnterpriseT1036.005Match Legitimate Resource Name or LocationSub-techniqueThis object uses Match Legitimate Resource Name or Location.
EnterpriseT1055Process InjectionThis object uses Process Injection.
EnterpriseT1106Native APIThis object uses Native API.
EnterpriseT1027Obfuscated Files or InformationThis object uses Obfuscated Files or Information.
EnterpriseT1129Shared ModulesThis object uses Shared Modules.
EnterpriseT1012Query RegistryThis object uses Query Registry.
EnterpriseT1573.001Symmetric CryptographySub-techniqueThis object uses Symmetric Cryptography.
EnterpriseT1548.002Bypass User Account ControlSub-techniqueThis object uses Bypass User Account Control.
EnterpriseT1057Process DiscoveryThis object uses Process Discovery.
EnterpriseT1204.001Malicious LinkSub-techniqueThis object uses Malicious Link.
EnterpriseT1566.001Spearphishing AttachmentSub-techniqueThis object uses Spearphishing Attachment.
EnterpriseT1053.005Scheduled TaskSub-techniqueThis object uses Scheduled Task.
EnterpriseT1204.002Malicious FileSub-techniqueThis object uses Malicious File.
EnterpriseT1059.001PowerShellSub-techniqueThis object uses PowerShell.
EnterpriseT1559.001Component Object ModelSub-techniqueThis object uses Component Object Model.
EnterpriseT1622Debugger EvasionThis object uses Debugger Evasion.
EnterpriseT1070.004File DeletionSub-techniqueThis object uses File Deletion.
Associated objects

Groups, software, and campaigns

GroupEnterprise

G1011: EXOTIC LILY

EXOTIC LILY is a financially motivated group that has been closely linked with Wizard Spider and the deployment of ransomware including Conti and Diavol. EXOTIC LILY may be acting as an initial access broker for other malicious actors, and has targeted a wide range of industries including IT, cybersecurity, and healthcare since at least September 2021.[1]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1082: System Information DiscoveryEnterpriseuses · TechniqueT1033: System Owner/User DiscoveryEnterpriseuses · TechniqueT1047: Windows Management InstrumentationEnterpriseuses · TechniqueT1041: Exfiltration Over C2 ChannelEnterpriseuses · TechniqueT1059.003: Windows Command ShellEnterpriseuses · TechniqueT1497.001: System ChecksEnterpriseuses · TechniqueT1140: Deobfuscate/Decode Files or InformationEnterpriseuses · TechniqueT1055.001: Dynamic-link Library InjectionEnterpriseuses · TechniqueT1560: Archive Collected DataEnterpriseuses · TechniqueT1497.003: Time Based ChecksEnterpriseuses · TechniqueT1218.008: OdbcconfEnterpriseuses · TechniqueT1005: Data from Local SystemEnterpriseuses · TechniqueT1518.001: Security Software DiscoveryEnterpriseuses · TechniqueT1055.004: Asynchronous Procedure CallEnterpriseuses · TechniqueT1059.005: Visual BasicEnterpriseuses · TechniqueT1102: Web ServiceEnterpriseuses · TechniqueT1497: Virtualization/Sandbox EvasionEnterpriseuses · TechniqueT1105: Ingress Tool TransferEnterpriseuses · TechniqueT1008: Fallback ChannelsEnterpriseuses · TechniqueT1566.002: Spearphishing LinkEnterpriseuses · TechniqueT1132.001: Standard EncodingEnterpriseuses · TechniqueT1218.011: Rundll32Enterpriseuses · TechniqueT1036.005: Match Legitimate Resource Name or LocationEnterpriseuses · GroupG1038: TA578Enterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.1
Created
Modified
Raw hash
9abedb58ac1d9e8f...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.1Current bundle9abedb58ac1d…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Google EXOTIC LILY March 2022

    Stolyarov, V. (2022, March 17). Exposing initial access broker with ties to Conti. Retrieved August 18, 2022.

    Open source URL
  2. [2]
    Proofpoint Bumblebee April 2022

    Merriman, K. and Trouerbach, P. (2022, April 28). This isn't Optimus Prime's Bumblebee but it's Still Transforming. Retrieved August 22, 2022.

    Open source URL
  3. [3]
    Symantec Bumblebee June 2022

    Kamble, V. (2022, June 28). Bumblebee: New Loader Rapidly Assuming Central Position in Cyber-crime Ecosystem. Retrieved August 24, 2022.

    Open source URL
  4. [4]
    Cybereason Bumblebee August 2022

    Cybereason. (2022, August 17). Bumblebee Loader – The High Road to Enterprise Domain Control. Retrieved August 29, 2022.

    Open source URL
  5. [5]
    Medium Ali Salem Bumblebee April 2022

    Salem, A. (2022, April 27). The chronicles of Bumblebee: The Hook, the Bee, and the Trickbot connection. Retrieved September 2, 2022.

    Open source URL
  6. [6]
    Latrodectus APR 2024

    Proofpoint Threat Research and Team Cymru S2 Threat Research. (2024, April 4). Latrodectus: This Spider Bytes Like Ice . Retrieved May 31, 2024.

    Open source URL
  7. [7]
    Google EXOTIC LILY March 2022

    Stolyarov, V. (2022, March 17). Exposing initial access broker with ties to Conti. Retrieved August 18, 2022.

    Open source URL
  8. [8]
    Google EXOTIC LILY March 2022

    Stolyarov, V. (2022, March 17). Exposing initial access broker with ties to Conti. Retrieved August 18, 2022.

    Open source URL
  9. [9]
    Proofpoint Bumblebee April 2022

    Merriman, K. and Trouerbach, P. (2022, April 28). This isn't Optimus Prime's Bumblebee but it's Still Transforming. Retrieved August 22, 2022.

    Open source URL
  10. [10]
    Proofpoint Bumblebee April 2022

    Merriman, K. and Trouerbach, P. (2022, April 28). This isn't Optimus Prime's Bumblebee but it's Still Transforming. Retrieved August 22, 2022.

    Open source URL
  11. [11]
    Symantec Bumblebee June 2022

    Kamble, V. (2022, June 28). Bumblebee: New Loader Rapidly Assuming Central Position in Cyber-crime Ecosystem. Retrieved August 24, 2022.

    Open source URL
  12. [12]
    Symantec Bumblebee June 2022

    Kamble, V. (2022, June 28). Bumblebee: New Loader Rapidly Assuming Central Position in Cyber-crime Ecosystem. Retrieved August 24, 2022.

    Open source URL
  13. [13]
    mitre-attackS1039
    Open source URL
  14. [14]
    mitre-attackS1039
    Open source URL
  15. [15]
    mitre-attackS1039
    Open source URL
  16. [16]
    Google EXOTIC LILY March 2022

    Stolyarov, V. (2022, March 17). Exposing initial access broker with ties to Conti. Retrieved August 18, 2022.

    Open source URL
  17. [17]
    Google EXOTIC LILY March 2022

    Stolyarov, V. (2022, March 17). Exposing initial access broker with ties to Conti. Retrieved August 18, 2022.

    Open source URL
  18. [18]
    Proofpoint Bumblebee April 2022

    Merriman, K. and Trouerbach, P. (2022, April 28). This isn't Optimus Prime's Bumblebee but it's Still Transforming. Retrieved August 22, 2022.

    Open source URL
  19. [19]
    Proofpoint Bumblebee April 2022

    Merriman, K. and Trouerbach, P. (2022, April 28). This isn't Optimus Prime's Bumblebee but it's Still Transforming. Retrieved August 22, 2022.

    Open source URL
  20. [20]
    Symantec Bumblebee June 2022

    Kamble, V. (2022, June 28). Bumblebee: New Loader Rapidly Assuming Central Position in Cyber-crime Ecosystem. Retrieved August 24, 2022.

    Open source URL
  21. [21]
    Symantec Bumblebee June 2022

    Kamble, V. (2022, June 28). Bumblebee: New Loader Rapidly Assuming Central Position in Cyber-crime Ecosystem. Retrieved August 24, 2022.

    Open source URL
  22. [22]
    Google EXOTIC LILY March 2022

    Stolyarov, V. (2022, March 17). Exposing initial access broker with ties to Conti. Retrieved August 18, 2022.

    Open source URL
  23. [23]
    Google EXOTIC LILY March 2022

    Stolyarov, V. (2022, March 17). Exposing initial access broker with ties to Conti. Retrieved August 18, 2022.

    Open source URL
  24. [24]
    Cybereason Bumblebee August 2022

    Cybereason. (2022, August 17). Bumblebee Loader – The High Road to Enterprise Domain Control. Retrieved August 29, 2022.

    Open source URL
  25. [25]
    Google EXOTIC LILY March 2022

    Stolyarov, V. (2022, March 17). Exposing initial access broker with ties to Conti. Retrieved August 18, 2022.

    Open source URL
  26. [26]
    Google EXOTIC LILY March 2022

    Stolyarov, V. (2022, March 17). Exposing initial access broker with ties to Conti. Retrieved August 18, 2022.

    Open source URL
  27. [27]
    Proofpoint Bumblebee April 2022

    Merriman, K. and Trouerbach, P. (2022, April 28). This isn't Optimus Prime's Bumblebee but it's Still Transforming. Retrieved August 22, 2022.

    Open source URL
  28. [28]
    Proofpoint Bumblebee April 2022

    Merriman, K. and Trouerbach, P. (2022, April 28). This isn't Optimus Prime's Bumblebee but it's Still Transforming. Retrieved August 22, 2022.

    Open source URL
  29. [29]
    Google EXOTIC LILY March 2022

    Stolyarov, V. (2022, March 17). Exposing initial access broker with ties to Conti. Retrieved August 18, 2022.

    Open source URL
  30. [30]
    Google EXOTIC LILY March 2022

    Stolyarov, V. (2022, March 17). Exposing initial access broker with ties to Conti. Retrieved August 18, 2022.

    Open source URL
  31. [31]
    Google EXOTIC LILY March 2022

    Stolyarov, V. (2022, March 17). Exposing initial access broker with ties to Conti. Retrieved August 18, 2022.

    Open source URL
  32. [32]
    Google EXOTIC LILY March 2022

    Stolyarov, V. (2022, March 17). Exposing initial access broker with ties to Conti. Retrieved August 18, 2022.

    Open source URL
  33. [33]
    Proofpoint Bumblebee April 2022

    Merriman, K. and Trouerbach, P. (2022, April 28). This isn't Optimus Prime's Bumblebee but it's Still Transforming. Retrieved August 22, 2022.

    Open source URL
  34. [34]
    Proofpoint Bumblebee April 2022

    Merriman, K. and Trouerbach, P. (2022, April 28). This isn't Optimus Prime's Bumblebee but it's Still Transforming. Retrieved August 22, 2022.

    Open source URL
  35. [35]
    Medium Ali Salem Bumblebee April 2022

    Salem, A. (2022, April 27). The chronicles of Bumblebee: The Hook, the Bee, and the Trickbot connection. Retrieved September 2, 2022.

    Open source URL
  36. [36]
    Medium Ali Salem Bumblebee April 2022

    Salem, A. (2022, April 27). The chronicles of Bumblebee: The Hook, the Bee, and the Trickbot connection. Retrieved September 2, 2022.

    Open source URL
  37. [37]
    Medium Ali Salem Bumblebee April 2022

    Salem, A. (2022, April 27). The chronicles of Bumblebee: The Hook, the Bee, and the Trickbot connection. Retrieved September 2, 2022.

    Open source URL
  38. [38]
    Proofpoint Bumblebee April 2022

    Merriman, K. and Trouerbach, P. (2022, April 28). This isn't Optimus Prime's Bumblebee but it's Still Transforming. Retrieved August 22, 2022.

    Open source URL
  39. [39]
    Proofpoint Bumblebee April 2022

    Merriman, K. and Trouerbach, P. (2022, April 28). This isn't Optimus Prime's Bumblebee but it's Still Transforming. Retrieved August 22, 2022.

    Open source URL
  40. [40]
    Proofpoint Bumblebee April 2022

    Merriman, K. and Trouerbach, P. (2022, April 28). This isn't Optimus Prime's Bumblebee but it's Still Transforming. Retrieved August 22, 2022.

    Open source URL
  41. [41]
    Proofpoint Bumblebee April 2022

    Merriman, K. and Trouerbach, P. (2022, April 28). This isn't Optimus Prime's Bumblebee but it's Still Transforming. Retrieved August 22, 2022.

    Open source URL
  42. [42]
    Symantec Bumblebee June 2022

    Kamble, V. (2022, June 28). Bumblebee: New Loader Rapidly Assuming Central Position in Cyber-crime Ecosystem. Retrieved August 24, 2022.

    Open source URL
  43. [43]
    Symantec Bumblebee June 2022

    Kamble, V. (2022, June 28). Bumblebee: New Loader Rapidly Assuming Central Position in Cyber-crime Ecosystem. Retrieved August 24, 2022.

    Open source URL
  44. [44]
    Cybereason Bumblebee August 2022

    Cybereason. (2022, August 17). Bumblebee Loader – The High Road to Enterprise Domain Control. Retrieved August 29, 2022.

    Open source URL
  45. [45]
    Cybereason Bumblebee August 2022

    Cybereason. (2022, August 17). Bumblebee Loader – The High Road to Enterprise Domain Control. Retrieved August 29, 2022.

    Open source URL
  46. [46]
    Proofpoint Bumblebee April 2022

    Merriman, K. and Trouerbach, P. (2022, April 28). This isn't Optimus Prime's Bumblebee but it's Still Transforming. Retrieved August 22, 2022.

    Open source URL
  47. [47]
    Proofpoint Bumblebee April 2022

    Merriman, K. and Trouerbach, P. (2022, April 28). This isn't Optimus Prime's Bumblebee but it's Still Transforming. Retrieved August 22, 2022.

    Open source URL
  48. [48]
    Cybereason Bumblebee August 2022

    Cybereason. (2022, August 17). Bumblebee Loader – The High Road to Enterprise Domain Control. Retrieved August 29, 2022.

    Open source URL
  49. [49]
    Cybereason Bumblebee August 2022

    Cybereason. (2022, August 17). Bumblebee Loader – The High Road to Enterprise Domain Control. Retrieved August 29, 2022.

    Open source URL
  50. [50]
    Cybereason Bumblebee August 2022

    Cybereason. (2022, August 17). Bumblebee Loader – The High Road to Enterprise Domain Control. Retrieved August 29, 2022.

    Open source URL
  51. [51]
    Cybereason Bumblebee August 2022

    Cybereason. (2022, August 17). Bumblebee Loader – The High Road to Enterprise Domain Control. Retrieved August 29, 2022.

    Open source URL
  52. [52]
    Medium Ali Salem Bumblebee April 2022

    Salem, A. (2022, April 27). The chronicles of Bumblebee: The Hook, the Bee, and the Trickbot connection. Retrieved September 2, 2022.

    Open source URL
  53. [53]
    Medium Ali Salem Bumblebee April 2022

    Salem, A. (2022, April 27). The chronicles of Bumblebee: The Hook, the Bee, and the Trickbot connection. Retrieved September 2, 2022.

    Open source URL
  54. [54]
    Proofpoint Bumblebee April 2022

    Merriman, K. and Trouerbach, P. (2022, April 28). This isn't Optimus Prime's Bumblebee but it's Still Transforming. Retrieved August 22, 2022.

    Open source URL
  55. [55]
    Proofpoint Bumblebee April 2022

    Merriman, K. and Trouerbach, P. (2022, April 28). This isn't Optimus Prime's Bumblebee but it's Still Transforming. Retrieved August 22, 2022.

    Open source URL
  56. [56]
    Symantec Bumblebee June 2022

    Kamble, V. (2022, June 28). Bumblebee: New Loader Rapidly Assuming Central Position in Cyber-crime Ecosystem. Retrieved August 24, 2022.

    Open source URL
  57. [57]
    Symantec Bumblebee June 2022

    Kamble, V. (2022, June 28). Bumblebee: New Loader Rapidly Assuming Central Position in Cyber-crime Ecosystem. Retrieved August 24, 2022.

    Open source URL
  58. [58]
    Proofpoint Bumblebee April 2022

    Merriman, K. and Trouerbach, P. (2022, April 28). This isn't Optimus Prime's Bumblebee but it's Still Transforming. Retrieved August 22, 2022.

    Open source URL
  59. [59]
    Proofpoint Bumblebee April 2022

    Merriman, K. and Trouerbach, P. (2022, April 28). This isn't Optimus Prime's Bumblebee but it's Still Transforming. Retrieved August 22, 2022.

    Open source URL
  60. [60]
    Proofpoint Bumblebee April 2022

    Merriman, K. and Trouerbach, P. (2022, April 28). This isn't Optimus Prime's Bumblebee but it's Still Transforming. Retrieved August 22, 2022.

    Open source URL
  61. [61]
    Proofpoint Bumblebee April 2022

    Merriman, K. and Trouerbach, P. (2022, April 28). This isn't Optimus Prime's Bumblebee but it's Still Transforming. Retrieved August 22, 2022.

    Open source URL
  62. [62]
    Symantec Bumblebee June 2022

    Kamble, V. (2022, June 28). Bumblebee: New Loader Rapidly Assuming Central Position in Cyber-crime Ecosystem. Retrieved August 24, 2022.

    Open source URL
  63. [63]
    Symantec Bumblebee June 2022

    Kamble, V. (2022, June 28). Bumblebee: New Loader Rapidly Assuming Central Position in Cyber-crime Ecosystem. Retrieved August 24, 2022.

    Open source URL
  64. [64]
    Proofpoint Bumblebee April 2022

    Merriman, K. and Trouerbach, P. (2022, April 28). This isn't Optimus Prime's Bumblebee but it's Still Transforming. Retrieved August 22, 2022.

    Open source URL
  65. [65]
    Proofpoint Bumblebee April 2022

    Merriman, K. and Trouerbach, P. (2022, April 28). This isn't Optimus Prime's Bumblebee but it's Still Transforming. Retrieved August 22, 2022.

    Open source URL
  66. [66]
    Proofpoint Bumblebee April 2022

    Merriman, K. and Trouerbach, P. (2022, April 28). This isn't Optimus Prime's Bumblebee but it's Still Transforming. Retrieved August 22, 2022.

    Open source URL
  67. [67]
    Proofpoint Bumblebee April 2022

    Merriman, K. and Trouerbach, P. (2022, April 28). This isn't Optimus Prime's Bumblebee but it's Still Transforming. Retrieved August 22, 2022.

    Open source URL
  68. [68]
    Google EXOTIC LILY March 2022

    Stolyarov, V. (2022, March 17). Exposing initial access broker with ties to Conti. Retrieved August 18, 2022.

    Open source URL
  69. [69]
    Google EXOTIC LILY March 2022

    Stolyarov, V. (2022, March 17). Exposing initial access broker with ties to Conti. Retrieved August 18, 2022.

    Open source URL
  70. [70]
    Proofpoint Bumblebee April 2022

    Merriman, K. and Trouerbach, P. (2022, April 28). This isn't Optimus Prime's Bumblebee but it's Still Transforming. Retrieved August 22, 2022.

    Open source URL
  71. [71]
    Proofpoint Bumblebee April 2022

    Merriman, K. and Trouerbach, P. (2022, April 28). This isn't Optimus Prime's Bumblebee but it's Still Transforming. Retrieved August 22, 2022.

    Open source URL
  72. [72]
    Symantec Bumblebee June 2022

    Kamble, V. (2022, June 28). Bumblebee: New Loader Rapidly Assuming Central Position in Cyber-crime Ecosystem. Retrieved August 24, 2022.

    Open source URL
  73. [73]
    Symantec Bumblebee June 2022

    Kamble, V. (2022, June 28). Bumblebee: New Loader Rapidly Assuming Central Position in Cyber-crime Ecosystem. Retrieved August 24, 2022.

    Open source URL
  74. [74]
    Proofpoint Bumblebee April 2022

    Merriman, K. and Trouerbach, P. (2022, April 28). This isn't Optimus Prime's Bumblebee but it's Still Transforming. Retrieved August 22, 2022.

    Open source URL
  75. [75]
    Proofpoint Bumblebee April 2022

    Merriman, K. and Trouerbach, P. (2022, April 28). This isn't Optimus Prime's Bumblebee but it's Still Transforming. Retrieved August 22, 2022.

    Open source URL
  76. [76]
    Cybereason Bumblebee August 2022

    Cybereason. (2022, August 17). Bumblebee Loader – The High Road to Enterprise Domain Control. Retrieved August 29, 2022.

    Open source URL
  77. [77]
    Cybereason Bumblebee August 2022

    Cybereason. (2022, August 17). Bumblebee Loader – The High Road to Enterprise Domain Control. Retrieved August 29, 2022.

    Open source URL
  78. [78]
    Proofpoint Bumblebee April 2022

    Merriman, K. and Trouerbach, P. (2022, April 28). This isn't Optimus Prime's Bumblebee but it's Still Transforming. Retrieved August 22, 2022.

    Open source URL
  79. [79]
    Proofpoint Bumblebee April 2022

    Merriman, K. and Trouerbach, P. (2022, April 28). This isn't Optimus Prime's Bumblebee but it's Still Transforming. Retrieved August 22, 2022.

    Open source URL
  80. [80]
    Proofpoint Bumblebee April 2022

    Merriman, K. and Trouerbach, P. (2022, April 28). This isn't Optimus Prime's Bumblebee but it's Still Transforming. Retrieved August 22, 2022.

    Open source URL
  81. [81]
    Proofpoint Bumblebee April 2022

    Merriman, K. and Trouerbach, P. (2022, April 28). This isn't Optimus Prime's Bumblebee but it's Still Transforming. Retrieved August 22, 2022.

    Open source URL
  82. [82]
    Proofpoint Bumblebee April 2022

    Merriman, K. and Trouerbach, P. (2022, April 28). This isn't Optimus Prime's Bumblebee but it's Still Transforming. Retrieved August 22, 2022.

    Open source URL
  83. [83]
    Proofpoint Bumblebee April 2022

    Merriman, K. and Trouerbach, P. (2022, April 28). This isn't Optimus Prime's Bumblebee but it's Still Transforming. Retrieved August 22, 2022.

    Open source URL
  84. [84]
    Symantec Bumblebee June 2022

    Kamble, V. (2022, June 28). Bumblebee: New Loader Rapidly Assuming Central Position in Cyber-crime Ecosystem. Retrieved August 24, 2022.

    Open source URL
  85. [85]
    Symantec Bumblebee June 2022

    Kamble, V. (2022, June 28). Bumblebee: New Loader Rapidly Assuming Central Position in Cyber-crime Ecosystem. Retrieved August 24, 2022.

    Open source URL
  86. [86]
    Medium Ali Salem Bumblebee April 2022

    Salem, A. (2022, April 27). The chronicles of Bumblebee: The Hook, the Bee, and the Trickbot connection. Retrieved September 2, 2022.

    Open source URL
  87. [87]
    Medium Ali Salem Bumblebee April 2022

    Salem, A. (2022, April 27). The chronicles of Bumblebee: The Hook, the Bee, and the Trickbot connection. Retrieved September 2, 2022.

    Open source URL
  88. [88]
    Latrodectus APR 2024

    Proofpoint Threat Research and Team Cymru S2 Threat Research. (2024, April 4). Latrodectus: This Spider Bytes Like Ice . Retrieved May 31, 2024.

    Open source URL
  89. [89]
    Cybereason Bumblebee August 2022

    Cybereason. (2022, August 17). Bumblebee Loader – The High Road to Enterprise Domain Control. Retrieved August 29, 2022.

    Open source URL
  90. [90]
    Cybereason Bumblebee August 2022

    Cybereason. (2022, August 17). Bumblebee Loader – The High Road to Enterprise Domain Control. Retrieved August 29, 2022.

    Open source URL
  91. [91]
    Medium Ali Salem Bumblebee April 2022

    Salem, A. (2022, April 27). The chronicles of Bumblebee: The Hook, the Bee, and the Trickbot connection. Retrieved September 2, 2022.

    Open source URL
  92. [92]
    Medium Ali Salem Bumblebee April 2022

    Salem, A. (2022, April 27). The chronicles of Bumblebee: The Hook, the Bee, and the Trickbot connection. Retrieved September 2, 2022.

    Open source URL
  93. [93]
    Proofpoint Bumblebee April 2022

    Merriman, K. and Trouerbach, P. (2022, April 28). This isn't Optimus Prime's Bumblebee but it's Still Transforming. Retrieved August 22, 2022.

    Open source URL
  94. [94]
    Proofpoint Bumblebee April 2022

    Merriman, K. and Trouerbach, P. (2022, April 28). This isn't Optimus Prime's Bumblebee but it's Still Transforming. Retrieved August 22, 2022.

    Open source URL
  95. [95]
    Cybereason Bumblebee August 2022

    Cybereason. (2022, August 17). Bumblebee Loader – The High Road to Enterprise Domain Control. Retrieved August 29, 2022.

    Open source URL
  96. [96]
    Cybereason Bumblebee August 2022

    Cybereason. (2022, August 17). Bumblebee Loader – The High Road to Enterprise Domain Control. Retrieved August 29, 2022.

    Open source URL
  97. [97]
    Medium Ali Salem Bumblebee April 2022

    Salem, A. (2022, April 27). The chronicles of Bumblebee: The Hook, the Bee, and the Trickbot connection. Retrieved September 2, 2022.

    Open source URL
  98. [98]
    Medium Ali Salem Bumblebee April 2022

    Salem, A. (2022, April 27). The chronicles of Bumblebee: The Hook, the Bee, and the Trickbot connection. Retrieved September 2, 2022.

    Open source URL
  99. [99]
    Proofpoint Bumblebee April 2022

    Merriman, K. and Trouerbach, P. (2022, April 28). This isn't Optimus Prime's Bumblebee but it's Still Transforming. Retrieved August 22, 2022.

    Open source URL
  100. [100]
    Proofpoint Bumblebee April 2022

    Merriman, K. and Trouerbach, P. (2022, April 28). This isn't Optimus Prime's Bumblebee but it's Still Transforming. Retrieved August 22, 2022.

    Open source URL
  101. [101]
    Medium Ali Salem Bumblebee April 2022

    Salem, A. (2022, April 27). The chronicles of Bumblebee: The Hook, the Bee, and the Trickbot connection. Retrieved September 2, 2022.

    Open source URL
  102. [102]
    Medium Ali Salem Bumblebee April 2022

    Salem, A. (2022, April 27). The chronicles of Bumblebee: The Hook, the Bee, and the Trickbot connection. Retrieved September 2, 2022.

    Open source URL
  103. [103]
    Medium Ali Salem Bumblebee April 2022

    Salem, A. (2022, April 27). The chronicles of Bumblebee: The Hook, the Bee, and the Trickbot connection. Retrieved September 2, 2022.

    Open source URL
  104. [104]
    Medium Ali Salem Bumblebee April 2022

    Salem, A. (2022, April 27). The chronicles of Bumblebee: The Hook, the Bee, and the Trickbot connection. Retrieved September 2, 2022.

    Open source URL
  105. [105]
    Google EXOTIC LILY March 2022

    Stolyarov, V. (2022, March 17). Exposing initial access broker with ties to Conti. Retrieved August 18, 2022.

    Open source URL
  106. [106]
    Google EXOTIC LILY March 2022

    Stolyarov, V. (2022, March 17). Exposing initial access broker with ties to Conti. Retrieved August 18, 2022.

    Open source URL
  107. [107]
    Proofpoint Bumblebee April 2022

    Merriman, K. and Trouerbach, P. (2022, April 28). This isn't Optimus Prime's Bumblebee but it's Still Transforming. Retrieved August 22, 2022.

    Open source URL
  108. [108]
    Proofpoint Bumblebee April 2022

    Merriman, K. and Trouerbach, P. (2022, April 28). This isn't Optimus Prime's Bumblebee but it's Still Transforming. Retrieved August 22, 2022.

    Open source URL
  109. [109]
    Cybereason Bumblebee August 2022

    Cybereason. (2022, August 17). Bumblebee Loader – The High Road to Enterprise Domain Control. Retrieved August 29, 2022.

    Open source URL
  110. [110]
    Cybereason Bumblebee August 2022

    Cybereason. (2022, August 17). Bumblebee Loader – The High Road to Enterprise Domain Control. Retrieved August 29, 2022.

    Open source URL
  111. [111]
    Medium Ali Salem Bumblebee April 2022

    Salem, A. (2022, April 27). The chronicles of Bumblebee: The Hook, the Bee, and the Trickbot connection. Retrieved September 2, 2022.

    Open source URL
  112. [112]
    Medium Ali Salem Bumblebee April 2022

    Salem, A. (2022, April 27). The chronicles of Bumblebee: The Hook, the Bee, and the Trickbot connection. Retrieved September 2, 2022.

    Open source URL
  113. [113]
    Proofpoint Bumblebee April 2022

    Merriman, K. and Trouerbach, P. (2022, April 28). This isn't Optimus Prime's Bumblebee but it's Still Transforming. Retrieved August 22, 2022.

    Open source URL
  114. [114]
    Proofpoint Bumblebee April 2022

    Merriman, K. and Trouerbach, P. (2022, April 28). This isn't Optimus Prime's Bumblebee but it's Still Transforming. Retrieved August 22, 2022.

    Open source URL
  115. [115]
    Symantec Bumblebee June 2022

    Kamble, V. (2022, June 28). Bumblebee: New Loader Rapidly Assuming Central Position in Cyber-crime Ecosystem. Retrieved August 24, 2022.

    Open source URL
  116. [116]
    Symantec Bumblebee June 2022

    Kamble, V. (2022, June 28). Bumblebee: New Loader Rapidly Assuming Central Position in Cyber-crime Ecosystem. Retrieved August 24, 2022.

    Open source URL
  117. [117]
    Cybereason Bumblebee August 2022

    Cybereason. (2022, August 17). Bumblebee Loader – The High Road to Enterprise Domain Control. Retrieved August 29, 2022.

    Open source URL
  118. [118]
    Cybereason Bumblebee August 2022

    Cybereason. (2022, August 17). Bumblebee Loader – The High Road to Enterprise Domain Control. Retrieved August 29, 2022.

    Open source URL
  119. [119]
    Proofpoint Bumblebee April 2022

    Merriman, K. and Trouerbach, P. (2022, April 28). This isn't Optimus Prime's Bumblebee but it's Still Transforming. Retrieved August 22, 2022.

    Open source URL
  120. [120]
    Proofpoint Bumblebee April 2022

    Merriman, K. and Trouerbach, P. (2022, April 28). This isn't Optimus Prime's Bumblebee but it's Still Transforming. Retrieved August 22, 2022.

    Open source URL
  121. [121]
    Cybereason Bumblebee August 2022

    Cybereason. (2022, August 17). Bumblebee Loader – The High Road to Enterprise Domain Control. Retrieved August 29, 2022.

    Open source URL
  122. [122]
    Cybereason Bumblebee August 2022

    Cybereason. (2022, August 17). Bumblebee Loader – The High Road to Enterprise Domain Control. Retrieved August 29, 2022.

    Open source URL
  123. [123]
    Medium Ali Salem Bumblebee April 2022

    Salem, A. (2022, April 27). The chronicles of Bumblebee: The Hook, the Bee, and the Trickbot connection. Retrieved September 2, 2022.

    Open source URL
  124. [124]
    Medium Ali Salem Bumblebee April 2022

    Salem, A. (2022, April 27). The chronicles of Bumblebee: The Hook, the Bee, and the Trickbot connection. Retrieved September 2, 2022.

    Open source URL
  125. [125]
    Proofpoint Bumblebee April 2022

    Merriman, K. and Trouerbach, P. (2022, April 28). This isn't Optimus Prime's Bumblebee but it's Still Transforming. Retrieved August 22, 2022.

    Open source URL
  126. [126]
    Proofpoint Bumblebee April 2022

    Merriman, K. and Trouerbach, P. (2022, April 28). This isn't Optimus Prime's Bumblebee but it's Still Transforming. Retrieved August 22, 2022.

    Open source URL
  127. [127]
    Symantec Bumblebee June 2022

    Kamble, V. (2022, June 28). Bumblebee: New Loader Rapidly Assuming Central Position in Cyber-crime Ecosystem. Retrieved August 24, 2022.

    Open source URL
  128. [128]
    Symantec Bumblebee June 2022

    Kamble, V. (2022, June 28). Bumblebee: New Loader Rapidly Assuming Central Position in Cyber-crime Ecosystem. Retrieved August 24, 2022.

    Open source URL
  129. [129]
    Proofpoint Bumblebee April 2022

    Merriman, K. and Trouerbach, P. (2022, April 28). This isn't Optimus Prime's Bumblebee but it's Still Transforming. Retrieved August 22, 2022.

    Open source URL
  130. [130]
    Proofpoint Bumblebee April 2022

    Merriman, K. and Trouerbach, P. (2022, April 28). This isn't Optimus Prime's Bumblebee but it's Still Transforming. Retrieved August 22, 2022.

    Open source URL
  131. [131]
    Symantec Bumblebee June 2022

    Kamble, V. (2022, June 28). Bumblebee: New Loader Rapidly Assuming Central Position in Cyber-crime Ecosystem. Retrieved August 24, 2022.

    Open source URL
  132. [132]
    Symantec Bumblebee June 2022

    Kamble, V. (2022, June 28). Bumblebee: New Loader Rapidly Assuming Central Position in Cyber-crime Ecosystem. Retrieved August 24, 2022.

    Open source URL
  133. [133]
    Cybereason Bumblebee August 2022

    Cybereason. (2022, August 17). Bumblebee Loader – The High Road to Enterprise Domain Control. Retrieved August 29, 2022.

    Open source URL
  134. [134]
    Cybereason Bumblebee August 2022

    Cybereason. (2022, August 17). Bumblebee Loader – The High Road to Enterprise Domain Control. Retrieved August 29, 2022.

    Open source URL
  135. [135]
    Medium Ali Salem Bumblebee April 2022

    Salem, A. (2022, April 27). The chronicles of Bumblebee: The Hook, the Bee, and the Trickbot connection. Retrieved September 2, 2022.

    Open source URL
  136. [136]
    Medium Ali Salem Bumblebee April 2022

    Salem, A. (2022, April 27). The chronicles of Bumblebee: The Hook, the Bee, and the Trickbot connection. Retrieved September 2, 2022.

    Open source URL
  137. [137]
    Proofpoint Bumblebee April 2022

    Merriman, K. and Trouerbach, P. (2022, April 28). This isn't Optimus Prime's Bumblebee but it's Still Transforming. Retrieved August 22, 2022.

    Open source URL
  138. [138]
    Proofpoint Bumblebee April 2022

    Merriman, K. and Trouerbach, P. (2022, April 28). This isn't Optimus Prime's Bumblebee but it's Still Transforming. Retrieved August 22, 2022.

    Open source URL
  139. [139]
    Symantec Bumblebee June 2022

    Kamble, V. (2022, June 28). Bumblebee: New Loader Rapidly Assuming Central Position in Cyber-crime Ecosystem. Retrieved August 24, 2022.

    Open source URL
  140. [140]
    Symantec Bumblebee June 2022

    Kamble, V. (2022, June 28). Bumblebee: New Loader Rapidly Assuming Central Position in Cyber-crime Ecosystem. Retrieved August 24, 2022.

    Open source URL
  141. [141]
    Medium Ali Salem Bumblebee April 2022

    Salem, A. (2022, April 27). The chronicles of Bumblebee: The Hook, the Bee, and the Trickbot connection. Retrieved September 2, 2022.

    Open source URL
  142. [142]
    Medium Ali Salem Bumblebee April 2022

    Salem, A. (2022, April 27). The chronicles of Bumblebee: The Hook, the Bee, and the Trickbot connection. Retrieved September 2, 2022.

    Open source URL
  143. [143]
    Proofpoint Bumblebee April 2022

    Merriman, K. and Trouerbach, P. (2022, April 28). This isn't Optimus Prime's Bumblebee but it's Still Transforming. Retrieved August 22, 2022.

    Open source URL
  144. [144]
    Medium Ali Salem Bumblebee April 2022

    Salem, A. (2022, April 27). The chronicles of Bumblebee: The Hook, the Bee, and the Trickbot connection. Retrieved September 2, 2022.

    Open source URL
  145. [145]
    Proofpoint Bumblebee April 2022

    Merriman, K. and Trouerbach, P. (2022, April 28). This isn't Optimus Prime's Bumblebee but it's Still Transforming. Retrieved August 22, 2022.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use