BumbleBee: A new trendy loader for Initial Access Brokers

**Executive Summary:** BumbleBee is a recently observed sophisticated loader distributed via spearphishing (ZIP->ISO->LNK) by Initial Access Brokers to deploy secondary payloads (Cobalt Strike, Meterpreter, ransomware families); it uses anti-analysis checks, in-memory PE loading, and RC4-obfuscated C2/campaign identifiers, and the report provides technical analysis, YARA rules, tracked C2 IPs, and sample hashes for detection and monitoring.