BumbleBee geofencing killswitch CIS locale check

Emiliano Mema@Nosalva

•updated Aug 18, 2026•0•0•2

Detects BumbleBee loader binaries that utilize the GetSystemDefaultLocaleName API to perform geofencing, intentionally exiting if the system locale matches specific CIS (Commonwealth of Independent States) region strings. This behavior is used by the malware to avoid infection of systems in these regions.