THREAT ANALYSIS REPORT: Bumblebee Loader – The High Road to Enterprise Domain Control
cybereason.com · Undated · Licence: not assessed; coordinator-only cache; do not redistribute
CVEs this report names
1 CVE- CVE-2020-1472Microsoft Netlogon Privilege Escalation VulnerabilityMicrosoft · NetlogonKEVRansomwarePublic exploitMedium · 5.5T1133External Remote ServicesT1068Exploitation for Privilege Escalation+4 more · 8 reports99.4%Top 0.06%86.8priority
Where it names them
CVE-2020-1472 Original (opens in a new tab) ↗
injected Cobalt Strike beacon: Bumblebee leveraging WMI to run wab.exe and wabmig.exe with injected floating code as seen in the Cybereason Defense Platform Privilege Escalation and Cobalt Strike deployment Bumblebee performs privilege escalation by loading an exploit for CVE-2020-1472 (Zerologon) into
Techniques drawn from this report
NoneNo passage in this report has been tied to an ATT&CK technique.