Compilation Timestamp 2025-05-01 18:04:59 UTC Entry Point 527** Contained Sections 7 Written in C++, this malware functions as a first-stage backdoor designed to establish an initial foothold before continuing its stealthy attack to move into MAAS, operations, and development. Bumblebee is primarily delivered via phishing emails—often disguised as invoices—but its scope also includes PDFs, voicemails, zip files, and images. The malware is highly evasive, routinely checking its environment, executing payloads, and creating LOLBins. Related to Operation Endgame, it notably disrupted regsvr32.exe in May 2024. This specific variant was created on May 1, 2025, and appeared to be set into operation on May 5, 2025—interestingly, just one day after Microsoft changed its DKIM, SPF, and DMARC rules. ed76019fbae16d3992d1939c38d620185f4520e128f80983a00cadc6a9c3b509 2025-05-05_77aa5cace886af5e61db8eb4c4cea57e_black-basta_cobalt-strike_satacom