Hackers use Bumblebee malware to infiltrate corporate networks

Bumblebee malware has reemerged, threatening corporate networks globally, following its first sighting since Europol’s May 2024 Operation Endgame.

Bumblebee malware

Bumblebee, first identified by Google’s Threat Analysis Group in March 2022, is a sophisticated downloader malware used by cybercriminals to breach corporate networks and install other malicious tools like Cobalt Strike and ransomware.

After a four-month break, Netskope researchers have detected a new Bumblebee campaign targeting U.S. organizations, signaling a possible change in the cyber threat landscape.

The infection starts with a phishing email containing a ZIP file. Once opened, the ZIP reveals an LNK file that, when clicked, triggers a sequence to download and run the Bumblebee payload in memory, avoiding detection by not writing the file to disk.

In this new variant, MSI files disguised as legitimate software installers, like Nvidia or Midjourney, are used to execute the payload entirely in memory. The malware also uses advanced techniques, such as the SelfReg table, to run without creating new processes, helping it evade security alerts.

Bumblebee’s reappearance aligns with the resurgence of several major threat groups in early 2024 after a temporary slowdown in cybercrime activity.

It has been connected to multiple high-profile ransomware groups like Quantum, Conti, and MountLocker.

Experts caution that Bumblebee is dangerous due to its use by skilled cybercriminals known for ransomware attacks. Its advanced evasion tactics and its role in providing initial access for ransomware groups make it a serious risk to corporate security.