Proofpoint Bumblebee April 2022

Bumblebee can use backup C2 servers if the primary server fails.

Bumblebee has been delivered as password-protected zipped ISO files and used control-flow-flattening to obfuscate the flow of functions.

Bumblebee can use WMI to gather system information and to spawn processes for code injection.

Bumblebee can achieve persistence by copying its DLL to a subdirectory of %APPDATA% and creating a Visual Basic Script that will load the DLL via a scheduled task.

The Bumblebee loader can support the `Dij` command which gives it the ability to inject DLLs into the memory of other processes.

Bumblebee can use asynchronous procedure call (APC) injection to execute commands received from C2.

Bumblebee can identify processes associated with analytical tools.

Bumblebee can use `cmd.exe` to drop and run files.

Bumblebee can create a Visual Basic script to enable persistence.

Bumblebee can uninstall its loader through the use of a `Sdl` command.

Bumblebee can enumerate the OS version and domain on a targeted system.

Bumblebee has been downloaded to victim's machines from OneDrive.

Bumblebee can download and execute additional payloads including through the use of a `Dex` command.

Bumblebee can use multiple Native APIs.

Bumblebee has the ability to base64 encode C2 server responses.

Bumblebee can deobfuscate C2 server responses and unpack its code on targeted hosts.

Bumblebee has relied upon a user downloading a file from a OneDrive link for execution.

EXOTIC LILY has gained execution through victims clicking on malicious LNK files contained within ISO files, which can execute hidden DLLs within the ISO.

Bumblebee has relied upon a user opening an ISO file to enable execution of malicious shortcut files and DLLs.

Bumblebee has used `rundll32` for execution of the loader component.

Bumblebee has the ability to perform anti-virtualization checks.

Bumblebee has the ability to set a hardcoded and randomized sleep interval.

Bumblebee can identify specific analytical tools based on running processes.

Bumblebee can use a COM object to execute queries to gather system information.

Bumblebee has gained execution through luring users into opening malicious attachments.

EXOTIC LILY conducted an e-mail thread-hijacking campaign with malicious ISO attachments.

Bumblebee has been spread through e-mail campaigns with malicious links.

Bumblebee can encrypt C2 requests and responses with RC4