“Bumblebee”, a malware loader discovered in April 2022, has been observed in a new campaign utilizing Google advertisements and SEO poisoning to target enterprises with promoted trojanized versions of popular applications, such as Cisco AnyConnect Secure Mobility Client, Zoom, ChatGPT, and Citrix. Bumblebee is often seen in phishing campaigns that deliver “payloads commonly associated with ransomware deployments” and has been actively evolving since its creation. Researchers emphasized that trojanizing installers for software that is “particularly topical (e.g., ChatGPT)” or often used by remote workers increases the likelihood of new infections. It has been observed that once Bumblebee has infected a victim device, the threat actor responsible moves laterally roughly three (3) hours after the initial infection and deploys Cobalt Strike as well as the legitimate AnyDesk and DameWare remote access tools. The actor uses a scheduled task to establish a persistence mechanism for Cobalt Strike, and additional tools are downloaded, such as various scripts and a network scanning utility mechanism. Researchers believe there are multiple threat groups and ransomware operations deploying Bumblebee, including Exotic Lily (a financially motivated threat group that uses ransomware variants such as “Conti” in its campaigns and is believed to be working with FIN12), Quantum, and MountLocker. CTIX analysts urge users to ensure all software is up to date with their latest patches to mitigate this risk. Indicators of compromise (IOCs) can be viewed in the reports linked below.