EXOTIC LILY
Also reported as DEV-0413.
Reports per quarter
Techniques in ATT&CK
Listed by ATT&CK
- T1102
- T1203
- T1204.001
- T1204.002
- T1566.001
- T1566.002
- T1566.003
- T1583.001
- T1585.001
- T1585.002
- T1589.002
- T1593.001
No report from the last two years names a technique ID.
CVEs named in reports
- CVE-2015-0096
- CVE-2019-6693 KEV ransomware
- CVE-2020-1472 KEV ransomware
- CVE-2021-34527 KEV ransomware
- CVE-2021-4044
- CVE-2021-40444 KEV ransomware
- CVE-2022-0609 KEV
- CVE-2022-30190 KEV ransomware
- CVE-2022-40684 KEV ransomware
- CVE-2023-34362 KEV ransomware
- CVE-2023-38831 KEV ransomware
- CVE-2024-1708 KEV ransomware
Show all 14 CVEs Show fewer
- CVE-2024-1709 KEV ransomware
- CVE-2026-21236
KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.
Reports
-
The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor BumbleBee (Malware Family)
Show all 75 reports Show fewer
-
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor BumbleBee notes
-
The DPRK delicate sound of cyber
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor The DPRK delicate sound of cyber
-
Bumblebee Malware Loader- Threat Analysis
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Bumblebee Malware Loader- Threat Analysis
-
The Dark Side of Bumblebee Malware Loader
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor The Dark Side of Bumblebee Malware Loader
-
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor From Ramnit To Bumblebee (via NeverQuest)- Similarities and Code Overlap Shed Light On Relationships Between Malware Developers
-
BumbleBee Roasts Its Way to Domain Admin
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor BumbleBee Roasts Its Way to Domain Admin
-
Flight of the Bumblebee- Email Lures and File Sharing Services Lead to Malware
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Flight of the Bumblebee- Email Lures and File Sharing Services Lead to Malware
-
Bumblebee Malware from TransferXL URLs
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Bumblebee Malware from TransferXL URLs
-
Bumblebee Malware from TransferXL URLs
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Bumblebee Malware from TransferXL URLs
-
New Bumblebee malware replaces Conti's BazarLoader in cyberattacks
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor New Bumblebee malware replaces Conti's BazarLoader in cyberattacks
-
Orion Threat Alert- Flight of the BumbleBee
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Orion Threat Alert- Flight of the BumbleBee
-
Exposing initial access broker with ties to Conti
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Exposing initial access broker with ties to Conti
-
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor What Wicked Webs We Un-weave
-
Analyzing attacks that exploit the CVE-2021-40444 MSHTML vulnerability
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Analyzing attacks that exploit the CVE-2021-40444 MSHTML vulnerability
Newest first. Details opens the report in Explore.