TA579 — Ransomware Profile

TA579 is the designation Proofpoint has applied since August 2021 to an email-borne malware distributor that supplies access to other criminal operators rather than running encryption tooling of its own. Earlier runs pushed BazaLoader and IcedID; the actor moved to the Bumblebee loader in 2022, and Proofpoint documented a March 2022 campaign that used DocuSign branding to steer recipients, via either a direct download link or an HTML attachment acting as a redirector, toward OneDrive-hosted ISO images carrying a shortcut file paired with a DLL. Proofpoint assessed with high confidence that every Bumblebee distributor it was watching drew the loader from one shared supplier, which places TA579 in a customer role rather than a developer one. Bumblebee itself was tied by Google's Threat Analysis Group to intrusion chains ending in Conti and Diavol deployments, and the loader families TA579 handled are the same ones that have repeatedly preceded hands-on ransomware. No public reporting assigns the group a country of origin.

Tools & malware

win.bumblebee Backdoor

Vendor research

Latrodectus Malware Analysis: IcedID 2.0 Proofpoint
Emerging Threats: Buzz of the Bumblebee – A new malicious loader Logpoint Security Research (now Guardsix)
Security Brief: Bumblebee Buzzes Back in Black Proofpoint
This isn't Optimus Prime's Bumblebee but it's Still Transforming Proofpoint

Read the full analysis on IntelFusions