A sophisticated group is using a webshell called BumbleBee in an ongoing xHunt campaign targeting Microsoft Exchange servers at Kuwaiti organizations.