S1039: Bumblebee

S1039: Bumblebee describes [Bumblebee](https://attack.mitre.org/software/S1039) is a custom loader written in C++ that has been used by multiple threat actors, including possible initial access brokers, to download and execute additional payloads since at least March 2022. [Bumblebee](https://attack.mitre.org/software/S1039) has been linked to ransomware operations including [Conti](https://attack.mitre.org/software/S0575), Quantum, and Mountlocker and derived its name from the appearance of "bumblebee" in the user-agent.(Citation: Google EX...

Executive priority

S1039: Bumblebee is an official MITRE ATT&CK software. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.

Technical view

Security teams should validate S1039: Bumblebee by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (Windows), and available local telemetry before making detection or mitigation decisions.

Likely telemetry

Official ATT&CK relationships and object metadata
Network, endpoint, and security-tool telemetry

Detection direction

Validate whether S1039: Bumblebee appears in your detection coverage and tabletop scenarios.
Use the object to align executive risk language with SOC, incident response, and detection engineering work.
Do not treat ATT&CK relationship context as attribution without corroborating evidence.

Mitigation priorities

Map the object to existing controls and identify missing telemetry or response ownership.
Prioritize mitigations that reduce exposure on the listed platforms and tactics.
Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.

Additional notes and limits

Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.

This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Bumblebee

Bumblebee is a custom loader written in C++ that has been used by multiple threat actors, including possible initial access brokers, to download and execute additional payloads since at least March 2022. Bumblebee has been linked to ransomware operations including Conti, Quantum, and Mountlocker and derived its name from the appearance of "bumblebee" in the user-agent.[1][2][3]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

Filter related techniques39 rows

Domain	ID	Name	Relationship / procedure
Enterprise	T1082	System Information Discovery	Bumblebee can enumerate the OS version and domain on a targeted system.[1][2][3]
Enterprise	T1033	System Owner/User Discovery	Bumblebee has the ability to identify the user name.[1]
Enterprise	T1047	Windows Management Instrumentation	Bumblebee can use WMI to gather system information and to spawn processes for code injection.[1][2]CitationCybereason Bumblebee August 2022
Enterprise	T1041	Exfiltration Over C2 Channel	Bumblebee can send collected data in JSON format to C2.[1]
Enterprise	T1059.003	Windows Command ShellSub-technique	Bumblebee can use `cmd.exe` to drop and run files.[1][2]
Enterprise	T1497.001	System ChecksSub-technique	Bumblebee has the ability to search for designated file paths and Registry keys that indicate a virtualized environment from multiple products.CitationMedium Ali Salem Bumblebee April 2022
Enterprise	T1140	Deobfuscate/Decode Files or Information	Bumblebee can deobfuscate C2 server responses and unpack its code on targeted hosts.[2]CitationMedium Ali Salem Bumblebee April 2022
Enterprise	T1055.001	Dynamic-link Library InjectionSub-technique	The Bumblebee loader can support the `Dij` command which gives it the ability to inject DLLs into the memory of other processes.[2][3]
Enterprise	T1560	Archive Collected Data	Bumblebee can compress data stolen from the Registry and volume shadow copies prior to exfiltration.CitationCybereason Bumblebee August 2022
Enterprise	T1497.003	Time Based ChecksSub-technique	Bumblebee has the ability to set a hardcoded and randomized sleep interval.[2]
Enterprise	T1218.008	OdbcconfSub-technique	Bumblebee can use `odbcconf.exe` to run DLLs on targeted hosts.CitationCybereason Bumblebee August 2022
Enterprise	T1005	Data from Local System	Bumblebee can capture and compress stolen credentials from the Registry and volume shadow copies.CitationCybereason Bumblebee August 2022
Enterprise	T1518.001	Security Software DiscoverySub-technique	Bumblebee can identify specific analytical tools based on running processes.[2][3]CitationMedium Ali Salem Bumblebee April 2022
Enterprise	T1055.004	Asynchronous Procedure CallSub-technique	Bumblebee can use asynchronous procedure call (APC) injection to execute commands received from C2.[2]
Enterprise	T1059.005	Visual BasicSub-technique	Bumblebee can create a Visual Basic script to enable persistence.[2][3]
Enterprise	T1102	Web Service	Bumblebee has been downloaded to victim's machines from OneDrive.[2]
Enterprise	T1497	Virtualization/Sandbox Evasion	Bumblebee has the ability to perform anti-virtualization checks.[2]
Enterprise	T1105	Ingress Tool Transfer	Bumblebee can download and execute additional payloads including through the use of a `Dex` command.[1][2][3]
Enterprise	T1008	Fallback Channels	Bumblebee can use backup C2 servers if the primary server fails.[2]
Enterprise	T1566.002	Spearphishing LinkSub-technique	Bumblebee has been spread through e-mail campaigns with malicious links.[2]CitationCybereason Bumblebee August 2022
Enterprise	T1132.001	Standard EncodingSub-technique	Bumblebee has the ability to base64 encode C2 server responses.[2]
Enterprise	T1218.011	Rundll32Sub-technique	Bumblebee has used `rundll32` for execution of the loader component.[2][3]
Enterprise	T1036.005	Match Legitimate Resource Name or LocationSub-technique	Bumblebee has named component DLLs "RapportGP.dll" to match those used by the security company Trusteer.CitationMedium Ali Salem Bumblebee April 2022
Enterprise	T1055	Process Injection	Bumblebee can inject code into multiple processes on infected endpoints.CitationCybereason Bumblebee August 2022
Enterprise	T1106	Native API	Bumblebee can use multiple Native APIs.[2]CitationMedium Ali Salem Bumblebee April 2022
Enterprise	T1027	Obfuscated Files or Information	Bumblebee has been delivered as password-protected zipped ISO files and used control-flow-flattening to obfuscate the flow of functions.[2]CitationCybereason Bumblebee August 2022CitationMedium Ali Salem Bumblebee April 2022
Enterprise	T1129	Shared Modules	Bumblebee can use `LoadLibrary` to attempt to execute GdiPlus.dll.CitationMedium Ali Salem Bumblebee April 2022
Enterprise	T1012	Query Registry	Bumblebee can check the Registry for specific keys.CitationMedium Ali Salem Bumblebee April 2022
Enterprise	T1573.001	Symmetric CryptographySub-technique	Bumblebee can encrypt C2 requests and responses with RC4[2]
Enterprise	T1548.002	Bypass User Account ControlSub-technique	Bumblebee has the ability to bypass UAC to deploy post exploitation tools with elevated privileges.CitationCybereason Bumblebee August 2022
Enterprise	T1057	Process Discovery	Bumblebee can identify processes associated with analytical tools.[2][3]CitationMedium Ali Salem Bumblebee April 2022
Enterprise	T1204.001	Malicious LinkSub-technique	Bumblebee has relied upon a user downloading a file from a OneDrive link for execution.[2]CitationCybereason Bumblebee August 2022
Enterprise	T1566.001	Spearphishing AttachmentSub-technique	Bumblebee has gained execution through luring users into opening malicious attachments.[2][3]CitationCybereason Bumblebee August 2022CitationMedium Ali Salem Bumblebee April 2022
Enterprise	T1053.005	Scheduled TaskSub-technique	Bumblebee can achieve persistence by copying its DLL to a subdirectory of %APPDATA% and creating a Visual Basic Script that will load the DLL via a scheduled task.[2][3]
Enterprise	T1204.002	Malicious FileSub-technique	Bumblebee has relied upon a user opening an ISO file to enable execution of malicious shortcut files and DLLs.[2][3]CitationCybereason Bumblebee August 2022CitationMedium Ali Salem Bumblebee April 2022
Enterprise	T1059.001	PowerShellSub-technique	Bumblebee can use PowerShell for execution.CitationMedium Ali Salem Bumblebee April 2022
Enterprise	T1559.001	Component Object ModelSub-technique	Bumblebee can use a COM object to execute queries to gather system information.[2]
Enterprise	T1622	Debugger Evasion	Bumblebee can search for tools used in static analysis.CitationMedium Ali Salem Bumblebee April 2022
Enterprise	T1070.004	File DeletionSub-technique	Bumblebee can uninstall its loader through the use of a `Sdl` command.[2]

Associated objects

Groups, software, and campaigns

G1011: EXOTIC LILY

EXOTIC LILY is a financially motivated group that has been closely linked with Wizard Spider and the deployment of ransomware including Conti and Diavol. EXOTIC LILY may be acting as an initial access broker for other malicious actors, and has targeted a wide range of industries including IT, cybersecurity, and healthcare since at least September 2021.[1]

G1038: TA578

TA578 is a threat actor that has used contact forms and email to initiate communications with victims and to distribute malware including Latrodectus, IcedID, and Bumblebee.[1][2]

Relationship explorer

All related ATT&CK context

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release: 19.2
Object version: 1.1
Created: Aug 19, 2022, 20:28 UTC (UTC+00:00)
Modified: Sep 17, 2024, 17:58 UTC (UTC+00:00)
Raw hash: 9abedb58ac1d9e8f...

Imported snapshots across ATT&CK releases(2)

Release	Bundle imported	Object version	Modified	Status	Raw hash
19.2	Aug 6, 2026, 02:58 UTC (UTC+00:00)	1.1	Sep 17, 2024, 17:58 UTC (UTC+00:00)	Current bundle	`9abedb58ac1d…`
19.1	Jul 14, 2026, 09:14 UTC (UTC+00:00)	1.1	Sep 17, 2024, 17:58 UTC (UTC+00:00)	Older bundle	`9abedb58ac1d…`

Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy

Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

[1]
Google EXOTIC LILY March 2022
Stolyarov, V. (2022, March 17). Exposing initial access broker with ties to Conti. Retrieved August 18, 2022.
Open source URL
[2]
Proofpoint Bumblebee April 2022
Merriman, K. and Trouerbach, P. (2022, April 28). This isn't Optimus Prime's Bumblebee but it's Still Transforming. Retrieved August 22, 2022.
Open source URL
[3]
Symantec Bumblebee June 2022
Kamble, V. (2022, June 28). Bumblebee: New Loader Rapidly Assuming Central Position in Cyber-crime Ecosystem. Retrieved August 24, 2022.
Open source URL
[4]
mitre-attackS1039
Open source URL

Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use