The intrusion began with the delivery of an ISO file containing a LNK file and a BumbleBee payload in the form of a hidden DLL file. A user on a workstation mounted the ISO file and executed the LNK file, running the Bumblebee payload. Around 15 minutes after the execution of BumbleBee, multiple … See more We offer multiple services including a Threat Feed service which tracks Command and Control frameworks such as Cobalt Strike, BumbleBee, Covenant, Metasploit, Empire, … See more The BumbleBee malware has been following the trend of using the effective combination of utilizing an .iso image containing a .lnk and … See more A new local administrator user was created on a server to facilitate persistence on the machine. The user account was … See more Following the user mounting the .iso file, they clicked on a .lnk file documents.lnk. As noted in previous reports, the .dll is hidden from the user unless they display hidden items in explorer like so: The .lnk contains instructions … See more WebJun 16, 2024 · DFIR NetWars are an incident simulator packed with a vast amount of forensic, malware analysis, threat hunting, and incident response challenges designed to help you gain proficiency without the risk …

The DFIR Report on Twitter: "BumbleBee Roasts Its Way to Domain …

WebMar 17, 2024 · The loader can be recognized by its use of a unique user-agent “bumblebee” which both variants share. The malware, hence dubbed BUMBLEBEE, uses WMI to collect various system details such as OS … WebBlackPerl DFIR has opened up the registration for #splunk 101 course which has been designed for Security Analysts. I loved the content from the Instructor and… Archan Choudhury on LinkedIn: #splunk #splunk #dfir #securityoperationscenter #securityanalyst greens and beans florist

BumbleBee: Round Two – The DFIR Report

WebOct 12, 2024 · Digital Forensics and Incident Response (DFIR) is a field within cybersecurity that focuses on the identification, investigation, and remediation of cyberattacks. Digital Forensics: A subset of forensic science that examines system data, user activity, and other pieces of digital evidence to determine if an attack is in progress … WebBlackPerl DFIR has opened up the registration for #splunk 101 course which has been designed for Security Analysts. I loved the content from the Instructor and… WebAug 8, 2024 · BumbleBee Roasts Its Way to Domain Admin - The DFIR Report In this intrusion from April 2024, the threat actors used BumbleBee as the initial access vector. … greens and beans recipe giada