MALWARE FAMILY

BumbleBee

Internal ID: win.bumblebee

aliases

Last seen:Mar 17, 2026

Intelligence Profile

This malware is delivered by an ISO file, with an DLL inside with a custom loader. Because of the unique user-agent "bumblebee" this malware was dubbed BUMBLEBEE. At the time of Analysis by Google's Threat Analysis Group (TAG) BumbleBee was observed to fetch Cobalt Strike Payloads.

Threat Analysis

BumbleBee is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.

External References

→http://www.microsoft.com/en-us/security/blog/2022/10/27/raspberry-robin-worm-part-of-larger-ecosystem-facilitating-pre-ransomware-activity/

→https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/bumblebee-docusign-campaign

→https://0xtoxin.github.io/malware%20analysis/Bumblebee-DocuSign-Campaign/

→https://bin.re/blog/the-dga-of-bumblebee/

→https://blog.cerbero.io/?p=2617

→https://blog.cyble.com/2022/06/07/bumblebee-loader-on-the-rise/

→https://blog.cyble.com/2022/09/07/bumblebee-returns-with-new-infection-technique/

→https://blog.gigamon.com/2021/09/10/rendering-threats-a-network-perspective/

→https://blog.google/threat-analysis-group/exposing-initial-access-broker-ties-conti

→https://blog.google/threat-analysis-group/exposing-initial-access-broker-ties-conti/

Quick Facts

TypeMalware Family

Aliases1

Also Known As

win.bumblebee

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search BumbleBee