Bumblebee Returns with New Infection Technique

This report analyzes a Bumblebee loader spam campaign that delivers a VHD containing a malicious LNK and an obfuscated PowerShell script; the multi-stage PowerShell loader decodes and decompresses an embedded DLL and uses Invoke-ReflectivePEInjection (PowerSploit) to reflectively load the Bumblebee DLL into PowerShell memory. The analysis includes file- and stage-level technical details, IoCs (MD5/SHA1/SHA256 hashes for VHD, LNK, PS1 stages, and final DLL), MITRE ATT&CK technique mappings, and recommended defensive measures such as user awareness, MFA, AV/URL blocking, network beacon monitoring, and DLP.