BumbleBee DGA C2 beaconing over HTTPS

Emiliano Mema@Nosalva

•updated Aug 18, 2026•0•0•1

Detects network activity associated with the BumbleBee malware, including domain-generation algorithm (DGA) pattern matches within TLS Server Name Indication (SNI) fields and direct connections to known C2 infrastructure IP addresses over HTTPS.