{
  "family": "beebone",
  "sample_count": 151,
  "category": "worm",
  "description": "Worm:Win32/Beebone (also known as AAHMBot) is a highly sophisticated, polymorphic trojan downloader and worm that functions as a highly resilient botnet, famously utilized in tandem with the Vobfus worm to create an unstoppable infection cycle.<br><br><b>Understanding Beebone</b><br>To the victim, Beebone is invisible, but it rapidly degrades network performance. For threat intelligence analysts, Beebone represents a masterclass in resilience and botnet architecture. It does not steal data directly; its sole purpose is to maintain an unbreakable foothold on the endpoint and act as a reliable delivery mechanism for other severe malware families (like ZeuS, Cryptolocker, or ZeroAccess).<br><br><b>Execution and Evasion Strategies</b><br>Beebone was famously partnered with the Vobfus worm. Vobfus would spread via USB drives and network shares, and its primary payload was to download Beebone. Beebone, in turn, would download updated variants of Vobfus. If AV deleted one, the other immediately downloaded a fresh, cryptographically distinct copy of its partner. Beebone is heavily polymorphic, repacking itself constantly. It establishes deep persistence, disables Windows Defender, and utilizes a complex, multi-tiered C2 infrastructure (often employing DGA - Domain Generation Algorithms) to ensure it can always receive commands.<br><br><b>Indicators of Compromise & Impact</b><br>The impact of Beebone is a fully compromised endpoint acting as a staging ground for the worst malware on the internet. Threat hunters will observe a massive volume of outbound DNS queries for pseudo-random, highly entropic domain names (DGA traffic). The presence of randomly named, highly obfuscated executables constantly reappearing in the <code>%AppData%</code> directory, even after deletion, is the classic Beebone/Vobfus signature.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1568.002",
    "T1562.001",
    "T1091",
    "T1105",
    "T1027.002"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1568.002",
      "name": "Dynamic Resolution: Domain Generation Algorithms",
      "tactic": "Command and Control"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1027.002",
      "name": "Obfuscated Files or Information: Software Packing",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1091",
      "name": "Replication Through Removable Media",
      "tactic": "Lateral Movement"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint immediately; Beebone's presence guarantees that secondary payloads (like ransomware or banking trojans) are actively downloading.",
    "Sinkhole the identified DGA domains at the corporate firewall to sever Beebone's ability to receive updated payloads or commands.",
    "Do not attempt manual file deletion; the Beebone/Vobfus symbiotic relationship will instantly restore the deleted files.",
    "Given the extreme resilience and polymorphic nature of the threat, performing a clean OS rebuild is the only guaranteed method of eradication."
  ],
  "what_to_avoid": [
    "Do not assume the endpoint is clean if your AV quarantines a single Beebone executable; the partner worm (Vobfus) is likely still active.",
    "Avoid plugging any USB drives into the infected machine, as the associated Vobfus worm will immediately infect them."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}