BumbleBee loader intrusion kerberoasted its way to Domain Admin

@TheDFIRReport created a really nice overview of an 11-day BumbleBee intrusion that ended with a kerberoasted service account holding Domain Admin rights. Especially, the visual timeline provides an excellent overview of the utilized techniques, from Cobalt Strike and AnyDesk persistence to AdFind and three different ways of dumping LSASS. The actors were evicted before their final actions, and the authors assess that domain-wide ransomware was the likely next step. Proofpoint first described the loader in April 2022, after at least three actors that usually distributed BazaLoader switched to Bumblebee. Google Threat Analysis Group provided a report on BumbleBee in March 2022, tying it to EXOTIC LILY, an initial access broker with links to Conti. Unit 42 showed how the same group, which it tracks as Projector Libra, impersonates employees of real companies and delivers the ISO files through file-sharing services.