English | हिन्दी

MEITY
Cyber Swachhta Kendra

Bumblebee Malware

Original Issue Date:- June 03, 2025
Virus Type:-Trojan
Severity:- Medium

It has been reported that a new variant of the Bumblebee malware is being used to target organizations for malicious activities. The malware is being spread through phishing email campaign in the global landscape.

Infection Mechanism

This phishing campaign targets multiple organizations and uses fake voicemail notifications to spread the Bumblebee malware.

Fig-1: Screenshot of the Voicemail email (Source: proofpoint)

The email contains a URL that leads to a Word document having name like "ReleaseEvans#96.docm" or in other such formats for targeting the organization.

Fig.2: Screenshot of the malicious Word document (Source: proofpoint)

Upon opening the document, it launches VBA macros that trigger a PowerShell command, which downloads and runs another PowerShell script from a remote server. That script subsequently retrieves and executes the Bumblebee loader.

As observed this malware is commonly distributed through phishing campaigns that deliver additional payloads, such as Cobalt Strike beacons, for network access and ransomware attacks.

Indicator of Compromise:

Example URL in email:
  • hxxps[:]//1drv[.]ms/w/s!At-ya4h-odvFe-M3JKvLzB19GQA?e=djPGy
  • hxxps[:]//1drv[.]ms/w/s!AuSuRB5deTxugQ-83_HzIqbBWuE1?e=9f2plW

SHA256 of example Word document downloaded from OneDrive:
  • 0cef17ba672793d8e32216240706cf46e3a2894d0e558906a1782405a8f4decf
  • 86a7da7c7ed5b915080ad5eaa0fdb810f7e91aa3e86034cbab13c59d3c581c0e



For more detailed list of IoC, kindly refer the below URL:

Best Practices and Recommendations:

  • Do not download and install applications from untrusted sources [offered via unknown websites/ links on unscrupulous messages]. Install applications downloaded from reputed application market only. Users must be aware while clicking on links during web search.
  • Update software and operating systems with the latest patches. Outdated applications and operating systems are the targets of most attacks.
  • Don't open attachments in unsolicited e-mails, even if they come from people in your contact list, and never click on a URL contained in an unsolicited e-mail, even if the link seems benign. In cases of genuine URLs close out the e-mail and go to the organization’s website directly through browser
  • It is advised to block office applications from creating executable files.
  • Install ad blockers to combat exploit kits such as Fallout that are distributed via malicious advertising.
  • Prohibit external FTP connections and blacklist downloads of known offensive security tools.
  • All operating systems and applications should be kept updated on a regular basis. Virtual patching can be considered for protecting legacy systems and networks. This measure hinders cybercriminals from gaining easy access to any system through vulnerabilities in outdated applications and software. Avoid applying updates / patches available in any unofficial channel.
  • Restrict execution of Power shell /WSCRIPT in an enterprise environment. Ensure installation and use of the latest version of PowerShell, with enhanced logging enabled. Script block logging and transcription enabled. Send the associated logs to a centralized log repository for monitoring and analysis. https://www.fireeye.com/blog/threat-research/2016/02/greater_visibilityt.html
  • Establish a Sender Policy Framework (SPF) for your domain, which is an email validation system designed to prevent spam by detecting email spoofing by which most of the ransomware samples successfully reaches the corporate email boxes.
  • Application whitelisting/Strict implementation of Software Restriction Policies (SRP) to block binaries running from %APPDATA% and %TEMP% paths. Ransomware sample drops and executes generally from these locations.
  • Users are advised to disable their RDP if not in use, if required, it should be placed behind the firewall and users are to bind with proper policies while using the RDP.
  • Block the attachments of file types, exe|pif|tmp|url|vb|vbe|scr|reg|cer|pst|cmd|com|bat|dll|dat|hlp|hta|js|wsf
  • Consider encrypting the confidential data as the ransomware generally targets common file types.
  • Perform regular backups of all critical information to limit the impact of data or system loss and to help expedite the recovery process. Ideally, this data should be kept on a separate device, and backups should be stored offline.
  • Network segmentation and segregation into security zones - help protect sensitive information and critical services. Separate administrative network from business processes with physical controls and Virtual Local Area Networks.


References: