Alert! Bumblebee, the replacement for BazaLoader ransomware

Bumblebee, that’s the name of the new downloader that has appeared. This sophisticated malware loader is being used as an initial access facilitator to deliver payloads such as ransomware, which aim to download and execute additional payloads.

This has been warned by Proofpoint, which since March has detected that at least three well-known groups of cybercriminals are using the new malware in various campaigns, whose activity coincides with that detailed by the Google Threat Analysis Group.

“The appearance of Bumblebee in the crimeware threat landscape and its apparent replacement of BazaLoader demonstrates the flexibility of cybercriminals to quickly change the way they operate by adopting new malware”, comments Sherrod DeGrippo, vice president of Research and Threat Detection at Proofpoint.

Bumblebee, new downloader

Bumblebee is a sophisticated downloader that contains anti-virtualization checks and has a unique implementation of common downloader capabilities. The name of the malware comes from the unique User-Agent “bumblebee” used in the first campaigns.

Alert! Bumblebee, the replacement for BazaLoader in ransomware campaigns

The malware emerges in the threat landscape coinciding with the recent disappearance of BazaLoader, a popular payload that makes it easier to track attacks, from Proofpoint’s threat activity logs since February 2022.

The use of the downloader by multiple cybercriminal groups can be considered a notable change in the landscape of cybercriminal threats. Therefore, the company estimates that the groups that use it can be considered initial access facilitators, who infiltrate and then sell access to ransomware authors.