Bumblebee malware wakes from hibernation, forgets what year it is, attacks with macros

Proofpoint researchers observed a resurgence of the Bumblebee loader in 2024 using a retro attack chain: phishing emails to US organizations (subject 'Voicemail February') point to OneDrive-hosted Word documents containing malicious VBA macros. The macro, if enabled, drops a script that executes PowerShell to download and run a Bumblebee DLL; historically Bumblebee has been used to deliver post-exploitation tools like Cobalt Strike. Indicators and mitigations (keep macros disabled, patch Office/Windows, user training) are provided, and attribution is uncertain.