Adventures in the land of BumbleBee – a new malicious loader

This report details NCC Group's analysis of BUMBLEBEE, a actively developed malicious Windows loader that employs anti-analysis techniques, process injection, and RC4-encrypted HTTPS C2 communications to fetch and execute payloads (notably Cobalt Strike and Meterpreter). It documents distribution methods (ISO, OneDrive, email thread hijacking), task types, persistence mechanisms, embedded libraries/compile-time details, evolving behavior, and a long list of IOCs tied to multiple operator group tags.