The Bumblebee malware loader has resurfaced in active campaigns four months after the multinational Operation Endgame disrupted its infrastructure in May 2024. Telemetry from Netskope Threat Labs reveals a retooled delivery chain initiated via phishing emails distributing ZIP archives with weaponized .lnk shortcuts. Upon execution, the shortcut launches an obfuscated PowerShell script that downloads a malicious Windows Installer package (%AppData%\y.msi) masquerading as legitimate NVIDIA drivers or Midjourney software.

To evade endpoint detection, the loader abandons disk-based DLL drops and rundll32.exe invocations. Instead, it exploits the MSI package’s internal SelfReg table to reflectively inject the 64-bit Bumblebee payload directly into the memory space of the native msiexec.exe process. Resident in memory, Bumblebee contacts actor-controlled C2 servers to execute reconnaissance and download second-stage payloads, allowing initial access brokers tied to TrickBot/Conti alumni to deploy Cobalt Strike beacons and stage ransomware intrusions.

Why it matters:

• Bullet 1 — Technical & Architecture Risk: Abusing MSI SelfReg tables enables unhooked, fileless DLL injection inside trusted Microsoft binaries (msiexec.exe), evading behavioral heuristics, parent-child process anomalies, and traditional file-integrity monitoring without dropping persistent binaries to disk.
• Bullet 2 — Strategic & Defender Imperative: Security teams must enforce strict AppLocker or Software Restriction Policies on msiexec.exe execution from non-standard user directories, monitor PowerShell invocations from shortcut extensions, and block outbound C2 beaconing to neutralize initial access before ransomware staging begins.