---
title: BumbleBee Returns With New Infection Chain
description: BumbleBee is a sophisticated loader that was first seen in the wild in 2022 and was a replacement for BazarLoader.
---

[Insights, news, education and announcements from PolySwarm](https://blog.polyswarm.io)

# [BumbleBee Returns With New Infection Chain](https://blog.polyswarm.io/bumblebee-returns-with-new-infection-chain)

 Written by [The Hivemind](https://blog.polyswarm.io/author/the-hivemind) | Oct 28, 2024 4:26:54 PM

**Related Families:** BazarLoader, BazaLoader

## **Executive Summary**

### BumbleBee is a sophisticated loader. It was first seen in the wild in 2022 and was a replacement for BazarLoader. It recently re-emerged with a new infection chain, indicating an evolving threat.

**Key Takeaways**

- BumbleBee is a sophisticated loader. 
- It was first seen in the wild in 2022 and was a replacement for BazarLoader.
- Despite disruption of malware operations by law enforcement in May 2024, BumbleBee recently re-emerged with a new infection chain. 
- Due to the re-emergence of BumbleBee and its shift in TTPs, PolySwarm analysts consider BumbleBee to be an evolving threat. 

**What is BumbleBee?**

### BumbleBee is a sophisticated loader. BumbleBee was first seen in the wild in 2022 and was a replacement for BazarLoader. Threat actors obtain access to corporate networks and use BumbleBee to deliver follow-on payloads, including Cobalt Strike beacons and ransomware. It recently re-emerged with a new infection chain, indicating an evolving threat. Netskope [reported](https://www.netskope.com/blog/new-bumblebee-loader-infection-chain-signals-possible-resurgence) on this activity. 

Conducted earlier this year, Operation Endgame, a Europol operation, was the largest law enforcement operation to target botnets. Its scope included takedown of IcedID, SystemBC, Pikabot, Smokeloader, Trickbot, and BumbleBee. Operation Endgame focused on disrupting malware operations, dismantling their infrastructure, freezing proceeds, and arresting key figures associated with the malware. The operation was successful at the time, resulting in 4 arrests, 16 location searches, takedown or disruption of over 100 servers, and seizure of over 2000 domains.

Despite taking a heavy hit from Operation Endgame in May, BumbleBee appears to be back in business. Along with this renewed activity, BumbleBee is also using a new infection chain. The infection chain begins with a phishing email that coerces the victim to download and extract a ZIP file, then execute the LNK file within. The LNK file, when executed, begins the next phase of infection, resulting in the download and execution of the BumbleBee payload in memory. This method allows the malware to avoid writing the DLL to disk. 

When the LNK file is opened, it executes a Powershell command, downloads an MSI file from the C2, and renames it. It then executes and installs the file using msiexec.exe. The threat actors use the /qn option to ensure no user interaction is required for this final step. The use of MSI files to execute payloads is not a new concept. Multiple malware families including DarkGate and Latrodectus are known to use this method. However, it is a new TTP for BumbleBee. 

Due to the re-emergence of BumbleBee and its shift in TTPs, PolySwarm analysts consider BumbleBee to be an evolving threat. 

**IOCs**

PolySwarm has multiple samples of BumbleBee.

 

[2bca5abfac168454ce4e97a10ccf8ffc068e1428fa655286210006b298de42fb](https://polyswarm.network/scan/results/file/2bca5abfac168454ce4e97a10ccf8ffc068e1428fa655286210006b298de42fb)

[c26344bfd07b871dd9f6bd7c71275216e18be265e91e5d0800348e8aa06543f9](https://polyswarm.network/scan/results/file/c26344bfd07b871dd9f6bd7c71275216e18be265e91e5d0800348e8aa06543f9)

[0ab5b3e9790aa8ada1bbadd5d22908b5ba7b9f078e8f5b4e8fcc27cc0011cce7](https://polyswarm.network/scan/results/file/0ab5b3e9790aa8ada1bbadd5d22908b5ba7b9f078e8f5b4e8fcc27cc0011cce7)

[106c81f547cfe8332110520c968062004ca58bcfd2dbb0accd51616dd694721f](https://polyswarm.network/scan/results/file/106c81f547cfe8332110520c968062004ca58bcfd2dbb0accd51616dd694721f)

[c26344bfd07b871dd9f6bd7c71275216e18be265e91e5d0800348e8aa06543f9](https://polyswarm.network/scan/results/file/c26344bfd07b871dd9f6bd7c71275216e18be265e91e5d0800348e8aa06543f9)

[0ab5b3e9790aa8ada1bbadd5d22908b5ba7b9f078e8f5b4e8fcc27cc0011cce7](https://polyswarm.network/scan/results/file/0ab5b3e9790aa8ada1bbadd5d22908b5ba7b9f078e8f5b4e8fcc27cc0011cce7)

[d3f551d1fb2c307edfceb65793e527d94d76eba1cd8ab0a5d1f86db11c9474c3](https://polyswarm.network/scan/results/file/d3f551d1fb2c307edfceb65793e527d94d76eba1cd8ab0a5d1f86db11c9474c3)

[d1cabe0d6a2f3cef5da04e35220e2431ef627470dd2801b4ed22a8ed9a918768](https://polyswarm.network/scan/results/file/d1cabe0d6a2f3cef5da04e35220e2431ef627470dd2801b4ed22a8ed9a918768)

[7df703625ee06db2786650b48ffefb13fa1f0dae41e521b861a16772e800c115](https://polyswarm.network/scan/results/file/7df703625ee06db2786650b48ffefb13fa1f0dae41e521b861a16772e800c115)

 

You can use the following CLI command to search for all BumbleBee samples in our portal:

**$ polyswarm link list -f BumbleBee**

 

***Don’t have a PolySwarm account? Go* [here](https://polyswarm.network/) *to sign up for a free Community plan or subscribe.***

***Contact us at* [hivemind@polyswarm.io](mailto:hivemind@polyswarm.io) *| Check out our* [blog](https://blog.polyswarm.io/) ***|* **[Subscribe](https://polyswarm.io/ransomwarereport/) *to our reports.***

 

[View full post](https://blog.polyswarm.io/bumblebee-returns-with-new-infection-chain)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "The Hivemind"
  },
  "dateModified" : "2024-10-28T16:26:54.945Z",
  "datePublished" : "2024-10-28T16:26:54Z",
  "headline" : "BumbleBee Returns With New Infection Chain",
  "image" : {
    "@type" : "ImageObject",
    "height" : 900,
    "url" : "https://5737925.fs1.hubspotusercontent-na1.net/hubfs/5737925/Threat%20Bulletin%20Images/BUMBLEBEE.jpg",
    "width" : 1600
  },
  "mainEntityOfPage" : "https://blog.polyswarm.io/bumblebee-returns-with-new-infection-chain",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60.0,
      "url" : "https://cdn2.hubspot.net/hubfs/5737925/Social%20Icons_PS-1.png",
      "width" : 59.820896
    },
    "name" : "The PolySwarm Blog"
  }
}
```