Detection Bumblebee Loader Execution

Kaung Khant Ko@kaungkhantko

•updated Aug 11, 2025•3•1•98

Detects the execution of a Bumblebee loader variant which uses rundll32.exe to launch its malicious DLL. This is immediately followed by the spawning of common reconnaissance commands to gather information about the compromised system and domain. This TTP was observed in the attack chain leading to Akira ransomware.