Technical Analysis of Bumblebee Malware Loader

Bumblebee is a sophisticated malware loader delivered via malicious ISO attachments (often in thread‑hijacked emails) that unpacks an embedded DLL, installs in-line hooks on ntdll functions to hollow gdiplus.dll with the final payload, and performs extensive anti‑VM, persistence, token manipulation, and code‑injection techniques; it has been observed delivering Cobalt Strike and Meterpreter payloads, communicates with C2 servers using the user-agent string "bumblebee", and includes IoCs (sample SHA256 and C2 45.147.229.23:443).