BumbleBeeMalware
- coldtrain
- shellsting
- shindig
This malware is delivered by an ISO file, with an DLL inside with a custom loader. Because of the unique user-agent "bumblebee" this malware was dubbed BUMBLEBEE. At the time of Analysis by Google's Threat Analysis Group (TAG) BumbleBee was observed to fetch Cobalt Strike Payloads.From MISP Galaxy
Last reported 3 months ago, by The DFIR Report7 reports
ATT&CK techniques
6 of 74 · each with the sentence it comes from- T1059.003Windows Command Shell
“T1059.003”
- T1014Rootkit
“…g Your Own Vulnerable Driver (BYOVD), también vemos a los atacantes abusar con frecuencia de utilidades legítimas de anti‑rootkit o utilizar enfoques driverless para bloquear la comunicación del software de endpoint detection and response (EDR) o suspenderlo…”
- T1027Obfuscated Files or Information
“T1027”
- T1059Command and Scripting Interpreter
“Command and Scripting Interpreter: Windows Command Shell”
- T1070.004File Deletion
“T1070.004”
- T1140Deobfuscate/Decode Files or Information
“T1140”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
7 reports, newest first · the exact sentence from each-
From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira“From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira”
-
PikaBot: a Guide to its Deep Secrets and Operations“…iminal services, notably through taking down key botnet infrastructures, including those of IcedID, SystemBC, PikaBot, SmokeLoader and BumbleBee.”
-
EDR killers explicados: Más allá de los drivers“VX Crypt no es exclusivo de este EDR killer; también ha sido utilizado para proteger otras familias de malware como BumbleBee.”
-
EDR killers explained: Beyond the drivers“VX Crypt is not unique to this EDR killer; it has also been used to protect other malware families such as BumbleBee.”
-
Ten Years of Resilience, Innovation & Community-Driven Defense“…and have been tracked in the wild by our security researchers at Huntress were disrupted, including Qakbot, DanaBot, Lactrodectus, and Bumblebee.”
-
Flash Alert: From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira“Flash Alert: From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira”
-
Top 3 Cybersecurity Threats of 2024 (So Far)“Despite becoming more prevalent this year, this shady attack method has actually been part of the toolkit for malware families like Bumblebee, Cicada, BadRabbit, and DarkGate since late 2023.”
Indicators in its reports
named in the reports above- opmanager[.]proin 2 reports
- ip-scanner[.]orgin 2 reports
- 170.130.55[.]223in 2 reports
- 188.40.187[.]145in 2 reports
- 109.205.195[.]211in 2 reports
- ev2sirbd269o5j[.]orgin 2 reports
- 2rxyt9urhq0bgj[.]orgin 2 reports
- 172.96.137[.]160in 2 reports
- 193.242.184[.]150in 2 reports
- 185.174.100[.]203in 2 reports
- 186b26df63df3b73…c1936f0aa5dain 2 reports
- a6df0b49a5ef9ffd…eb1914945331in 2 reports
- de730d969854c369…9fff6edce19din 2 reports
- 82ed942a52cdcf12…ba37619661a3in 2 reports
- 54547180a99474b0…8f3eea78b531in 2 reports
- 75f85caea52fe5a1…bd3161690addin 2 reports
- 002573d80091f7f8…2b85fa915f19in 2 reports
- 1e7567c0d525ad03…f40541994411in 2 reports
- 65c2388b0afb1d1f…d8d6cd8b5645in 2 reports
- a9f37104d2d89051…bff44d147e67in 2 reports
Copy these 20 indicators · defanged
Thanks — we review every report.