Bumblebee
Software · ATTACK:enterprise:S1039
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S1039",
"title": "Bumblebee",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S1039",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--04378e79-4387-468a-a8f7-f974b8254e44",
"external_id": "S1039",
"domain": "enterprise",
"created": "2022-08-19T20:28:36.981Z",
"modified": "2024-09-17T17:58:55.921Z",
"version": "1.1",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "Symantec Bumblebee June 2022",
"url": "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bumblebee-loader-cybercrime"
},
{
"source_name": "Proofpoint Bumblebee April 2022",
"url": "https://www.proofpoint.com/us/blog/threat-insight/bumblebee-is-still-transforming"
},
{
"source_name": "Google EXOTIC LILY March 2022",
"url": "https://blog.google/threat-analysis-group/exposing-initial-access-broker-ties-conti/"
}
]
}Explicit source assertions (41)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S1039 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--02a1f8ce-390e-46e4-b945-9cd61c593f9f
Symantec Bumblebee June 2022 · Proofpoint Bumblebee April 2022 · Google EXOTIC LILY March 2022ATTACK:enterprise:S1039 → uses → ATTACK:enterprise:T1033
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--128eeb8d-c492-4dbf-a423-0b68a4b53443
Google EXOTIC LILY March 2022ATTACK:enterprise:S1039 → uses → ATTACK:enterprise:T1047
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1c935a6d-dd69-4be3-bfed-56c01d0f9413
Cybereason Bumblebee August 2022 · Proofpoint Bumblebee April 2022 · Google EXOTIC LILY March 2022ATTACK:enterprise:S1039 → uses → ATTACK:enterprise:T1041
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1d11c326-7640-4ddd-b5fe-c8eaf4097c20
Google EXOTIC LILY March 2022ATTACK:enterprise:S1039 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1e8fbfc4-4992-490a-9a91-e304eb965c0d
Proofpoint Bumblebee April 2022 · Google EXOTIC LILY March 2022ATTACK:enterprise:S1039 → uses → ATTACK:enterprise:T1497.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2815c919-1fcb-4ddc-bb04-56dff63854e7
Medium Ali Salem Bumblebee April 2022ATTACK:enterprise:S1039 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3471a32a-47fc-4ba7-ac67-887d9872e316
Proofpoint Bumblebee April 2022 · Medium Ali Salem Bumblebee April 2022ATTACK:enterprise:S1039 → uses → ATTACK:enterprise:T1055.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3bcce871-6b9d-4eaf-9364-80dea3cb7ef9
Symantec Bumblebee June 2022 · Proofpoint Bumblebee April 2022ATTACK:enterprise:S1039 → uses → ATTACK:enterprise:T1560
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3df9c843-4833-45f9-a1ae-f7231d8410c4
Cybereason Bumblebee August 2022ATTACK:enterprise:S1039 → uses → ATTACK:enterprise:T1497.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--45eef730-8c5b-45fb-9cd9-c7998a764898
Proofpoint Bumblebee April 2022ATTACK:enterprise:S1039 → uses → ATTACK:enterprise:T1218.008
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--463dc38c-7b05-4ddf-aa27-cce8afef9171
Cybereason Bumblebee August 2022ATTACK:enterprise:S1039 → uses → ATTACK:enterprise:T1005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4c530431-2ad0-4ee9-97d1-4e489aa2436f
Cybereason Bumblebee August 2022ATTACK:enterprise:S1039 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--502d4200-719b-4b42-8221-0ecd0ed0d6e7
Symantec Bumblebee June 2022 · Proofpoint Bumblebee April 2022 · Medium Ali Salem Bumblebee April 2022ATTACK:enterprise:S1039 → uses → ATTACK:enterprise:T1055.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5bc09eae-6b6c-4dd3-9e27-a2f26f0a6468
Proofpoint Bumblebee April 2022ATTACK:enterprise:S1039 → uses → ATTACK:enterprise:T1059.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5f7db516-c204-4e6b-9bda-b891bf763843
Symantec Bumblebee June 2022 · Proofpoint Bumblebee April 2022ATTACK:enterprise:S1039 → uses → ATTACK:enterprise:T1102
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--63b1af38-765d-4181-add0-dbd3f31941ff
Proofpoint Bumblebee April 2022ATTACK:enterprise:S1039 → uses → ATTACK:enterprise:T1497
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6515b62c-af1a-4b22-baca-0710ac898815
Proofpoint Bumblebee April 2022ATTACK:enterprise:S1039 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7065f730-96fc-4a33-b6fb-101af568b74b
Symantec Bumblebee June 2022 · Proofpoint Bumblebee April 2022 · Google EXOTIC LILY March 2022ATTACK:enterprise:S1039 → uses → ATTACK:enterprise:T1008
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7327153c-c123-401b-b675-554b8070fbed
Proofpoint Bumblebee April 2022ATTACK:enterprise:S1039 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--741c03f1-5c9c-4737-bf2d-279503a042ab
Cybereason Bumblebee August 2022 · Proofpoint Bumblebee April 2022ATTACK:enterprise:S1039 → uses → ATTACK:enterprise:T1132.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7a4ed5e2-6a96-4faf-b647-2372490cfcb2
Proofpoint Bumblebee April 2022ATTACK:enterprise:S1039 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7af072a8-2a24-42c4-9cdc-7e060693849e
Symantec Bumblebee June 2022 · Proofpoint Bumblebee April 2022ATTACK:enterprise:S1039 → uses → ATTACK:enterprise:T1036.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7caebc50-4c1b-4ac0-953b-705d9e1026f4
Medium Ali Salem Bumblebee April 2022ATTACK:enterprise:G1038 → uses → ATTACK:enterprise:S1039
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--81731804-3559-427b-8fdf-c00d2fc4632b
Latrodectus APR 2024ATTACK:enterprise:S1039 → uses → ATTACK:enterprise:T1055
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--836575fd-ffa1-4531-8c16-c875b7f0c177
Cybereason Bumblebee August 2022ATTACK:enterprise:S1039 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8ba708a9-07a3-4c4e-8fee-15a1cdabf2f7
Proofpoint Bumblebee April 2022 · Medium Ali Salem Bumblebee April 2022ATTACK:enterprise:S1039 → uses → ATTACK:enterprise:T1027
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a0040bac-4445-4999-bf0f-53b340f02218
Cybereason Bumblebee August 2022 · Proofpoint Bumblebee April 2022 · Medium Ali Salem Bumblebee April 2022ATTACK:enterprise:S1039 → uses → ATTACK:enterprise:T1129
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a7ec0d1d-462b-4909-acee-f2aa1f9199b1
Medium Ali Salem Bumblebee April 2022ATTACK:enterprise:S1039 → uses → ATTACK:enterprise:T1012
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--acbf0f3f-5dd4-42ad-9399-047b8ff5dc0a
Medium Ali Salem Bumblebee April 2022ATTACK:enterprise:G1011 → uses → ATTACK:enterprise:S1039
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b2a03f9f-883b-4ced-b4a2-cd49d8e7a3aa
Google EXOTIC LILY March 2022ATTACK:enterprise:S1039 → uses → ATTACK:enterprise:T1573.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b5cbd882-e5dc-468e-b853-5e6e24583741
Proofpoint Bumblebee April 2022ATTACK:enterprise:S1039 → uses → ATTACK:enterprise:T1548.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b8113737-894f-42de-b607-9d4905fcdfc3
Cybereason Bumblebee August 2022ATTACK:enterprise:S1039 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c0fc62bc-ac39-4840-968d-8a3f8f3ce6a0
Symantec Bumblebee June 2022 · Proofpoint Bumblebee April 2022 · Medium Ali Salem Bumblebee April 2022ATTACK:enterprise:S1039 → uses → ATTACK:enterprise:T1204.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c4600507-03d9-471f-a175-d5fd3953c0c6
Cybereason Bumblebee August 2022 · Proofpoint Bumblebee April 2022ATTACK:enterprise:S1039 → uses → ATTACK:enterprise:T1566.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c7721c41-83aa-4988-b431-e3135028d11e
Cybereason Bumblebee August 2022 · Symantec Bumblebee June 2022 · Proofpoint Bumblebee April 2022 · Medium Ali Salem Bumblebee April 2022ATTACK:enterprise:S1039 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cf72062c-b62f-4127-b7e3-ac3f941a9599
Symantec Bumblebee June 2022 · Proofpoint Bumblebee April 2022ATTACK:enterprise:S1039 → uses → ATTACK:enterprise:T1204.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d0efbf46-7f6a-4bf9-be4f-a52cd510174c
Cybereason Bumblebee August 2022 · Symantec Bumblebee June 2022 · Proofpoint Bumblebee April 2022 · Medium Ali Salem Bumblebee April 2022ATTACK:enterprise:S1039 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d4bf0c1a-d5cf-4d49-b0eb-4d347722ab63
Medium Ali Salem Bumblebee April 2022ATTACK:enterprise:S1039 → uses → ATTACK:enterprise:T1559.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--eedbb286-aa6f-49a6-8e6a-283ad45f8938
Proofpoint Bumblebee April 2022ATTACK:enterprise:S1039 → uses → ATTACK:enterprise:T1622
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f015b898-b057-40e4-9add-c4fa1e100f7e
Medium Ali Salem Bumblebee April 2022ATTACK:enterprise:S1039 → uses → ATTACK:enterprise:T1070.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f1122ac6-d8f4-43d4-9102-0a41db245b69
Proofpoint Bumblebee April 2022