Threat reportMalwareTL-2026-1004
SEO Poisoning Supply Chain Campaign Distributing Akira Ransomware via Trojanized Enterprise Software
SEO Poisoning Supply Chain Campaign Distributing Akira (TL-2026-1004), also tracked as Bing SEO Poisoning to Akira Campaign, is a critical-severity malware campaign, first published 2026-06-30 and last reviewed 2026-08-06. It is attributed to Akira Ransomware Gang (Russia) with high confidence, affects Zoho/ManageEngine ManageEngine OpManager, references 1 CVE (CVE-2024-40766), maps to 34 MITRE ATT&CK techniques (T1003, T1005, T1021), and is covered by 9 detection rules and 41 indicators of compromise.
- Severity
- CRITICALAssessed severity
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 34MITRE ATT&CK
- Actors
- 2Akira Ransomware Gang
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 41Indicators of compromise
Key facts for TL-2026-1004
- Threat ID
- TL-2026-1004
- Also known as
- Bing SEO Poisoning to Akira Campaign, From Bing Search to Ransomware, BumbleBee-AdaptixC2-Akira Supply Chain Attack
- Severity
- CRITICAL
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution
- Akira Ransomware Gang, BumbleBee Operators
- Attribution confidence
- HIGH
- Nation-state nexus
- Russia
- Motivation
- FINANCIAL
- Target sectors
- manufacturing, construction, engineering, professional-services, health, finance, technology, education, critical-infrastructure
- Target regions
- North America, Europe, australia, Asia-Pacific
- Detection rules
- 9
- Indicators of compromise
- 41
- Updates
- 2026-08-06
Malware and tooling in SEO Poisoning Supply Chain Campaign Distributing Akira
Malware and tooling: AdaptixC2, Akira, Bumblebee - S1039, FileZilla, Impacket - S0357, RustDesk
How SEO Poisoning Supply Chain Campaign Distributing Akira works
Multi-threat-actor SEO poisoning campaign targets enterprise IT administrators through Bing search results, distributing trojanized ManageEngine OpManager, ZenMap, WinMTR, and other network tools. Infection chain: BumbleBee loader → AdaptixC2 C2 beacon → credential theft/lateral movement → 75GB+ exfiltration → Akira ransomware deployment in 9-44 hours. Active since May 2025 with 980+ confirmed victims and $244M+ in collected ransom.
This is an exceptionally high-impact, ongoing supply chain compromise campaign leveraging search engine manipulation to distribute malware at enterprise scale. Threat actors have poisoned Bing organic search results for legitimate software keywords (ManageEngine OpManager, ZenMap, WinMTR, Advanced IP Scanner, Milestone XProtect, PulseSecure, SonicWall), presenting cloned legitimate websites that redirect to malicious download servers hosting trojanized MSI installers. When executed by unsuspecting IT administrators, the installer triggers a sophisticated multi-stage attack: BumbleBee malware loader executes via DLL sideloading (msimg32.dll hijacking consent.exe), immediately reaching out to command servers. Within 5 hours, AdaptixC2 C2 beacon deploys, enabling reconnaissance and remote code execution. Over Days 1-3, attackers conduct comprehensive network mapping, extract domain credentials (NTDS.dit dumps, LSASS memory, Veeam database credentials), create backdoor admin accounts (backup_DA, backup_EA), and deploy RustDesk for persistent remote access. Concurrent with lateral movement, attackers exfiltrate 75GB+ of sensitive data via SFTP to external infrastructure (185.174.100.203, 193.242.184.150) in parallel sessions. Finally, Akira ransomware deploys across the network, encrypting critical systems and threatening public data release (double extortion). Time-to-ransom ranges from 9 hours (fastest observed) to 44 hours. Campaign is active across multiple threat actor groups (4+ confirmed), targeting manufacturing, construction, engineering, healthcare, and critical infrastructure sectors globally. Total confirmed victims: 980+ (Jan-Dec 2025), with 277,800 compromised hosts identified in 13-day window (December 2025). Total ransom collected: $244M+ through 2025.
MITRE ATT&CK techniques used in TL-2026-1004
Credential Access
T1003 OS Credential Dumping; T1555 Credentials from Password Stores
Collection
T1005 Data from Local System; T1039 Data from Network Shared Drive; T1074 Data Staged
Lateral Movement
T1021 Remote Services; T1550 Use Alternate Authentication Material; T1570 Lateral Tool Transfer
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1055 Process Injection; T1070 Indicator Removal
Exfiltration
T1041 Exfiltration Over C2 Channel; T1048 Exfiltration Over Alternative Protocol
Discovery
T1046 Network Service Discovery; T1069 Permission Groups Discovery; T1082 System Information Discovery; T1087 Account Discovery
Persistence
T1053 Scheduled Task/Job; T1543 Create or Modify System Process; T1547 Boot or Logon Autostart Execution
Execution
T1059 Command and Scripting Interpreter; T1204 User Execution
Command and Control
T1071 Application Layer Protocol; T1568 Dynamic Resolution; T1573 Encrypted Channel
Initial Access
T1189 Drive-by Compromise; T1566 Phishing
stealth
T1218 System Binary Proxy Execution; T1574 Hijack Execution Flow
Impact
T1486 Data Encrypted for Impact; T1490 Inhibit System Recovery
Privilege Escalation
T1548 Abuse Elevation Control Mechanism
defense-impairment
Affected products and versions in SEO Poisoning Supply Chain Campaign Distributing Akira
- Zoho/ManageEngine — ManageEngine OpManager
Vulnerable versions: All versions when distributed via SEO-poisoned search results - Various (Linux Foundation) — ZenMap
Vulnerable versions: 7.97+ - SACERT — WinMTR
Vulnerable versions: Current versions when via SEO-poisoned results - Nirsoft — Advanced IP Scanner
Vulnerable versions: All versions via trojanized distribution - Milestone Systems — XProtect
Vulnerable versions: Current versions via malvertising - Pulse Connect — PulseSecure
Vulnerable versions: Impersonation vector via pulsesecure[.]pro - SonicWall — SonicOS (Gen 5, 6, 7)
Vulnerable versions: Gen 5 5.9.2.14-12o+; Gen 6 6.5.4.14-109n+; Gen 7 7.0.1-5035+ - Microsoft — Windows Server / Windows Desktop
Vulnerable versions: All versions running affected software
Remediation for SEO Poisoning Supply Chain Campaign Distributing Akira
Patches
- Patch SonicWall SonicOS to v7.3.0+ to address CVE-2024-40766 (parallel attack vector)
- Validate all enterprise software downloads exclusively from official vendor domains only
- Implement code-signing certificate validation for all MSI executables
- Deploy Application Whitelisting rules for all vendor-approved software
Immediate actions
- Block all malvertising domains at DNS/firewall: opmanager[.]pro, zenmap[.]pro, winmtr[.]org, nir-soft[.]org, sonicwall[.]pro, pulsesecure[.]pro, milestonesys[.]org, hanwhavision[.]org, netcrunch[.]org, ip-scanner[.]org
- Block Bing search result redirects from download-center[.]online, download-server[.]online, software-server[.]online, soft-server[.]online, hub28[.]shop, vpncorporate[.]online
- Kill any BumbleBee/AdaptixC2/Akira processes discovered; isolate affected systems immediately
- Query domain for unauthorized admin accounts: backup_DA, backup_EA — delete if present
- Disable/remove RustDesk services if unplanned installation detected
- Conduct NTDS.dit review for credential compromise; reset all domain admin passwords
- Block C2 IOCs at network perimeter: 188.40.187.145, 109.205.195.211, 171.22.183.43, 172.96.137.160
Workarounds
- Restrict search to Google/DuckDuckGo instead of Bing to reduce exposure to SEO poisoning
- Block download-center[.]online, download-server[.]online, and related malvertising domains at DNS level
- Use URL filtering to block search results with known malicious redirection patterns
- Restrict RustDesk/AnyDesk/TeamViewer installation and usage via Group Policy
- Monitor for and kill consent.exe processes with suspicious child processes
- Delete Volume Shadow Copies via Group Policy if Akira detected (prevents victim self-recovery)
Longer-term hardening
- Deploy EDR (Endpoint Detection & Response) with behavioral detection for BumbleBee/Akira execution patterns and process injection signatures
- Implement application whitelisting to block unsigned executables from AppData, Temp, Downloads directories
- Deploy Sysmon/Windows Defender Application Guard on all endpoints accessing management/administrative tools
- Enable PowerShell Script Block Logging and AMSI (Antimalware Scan Interface) globally
- Monitor DNS for DGA domain queries (.org/.life pattern: 13-char alphanumeric + TLD)
- Implement SIEM alerts for suspicious processes: consent.exe + msimg32.dll, wbadmin with 127.0.0.1 targets, credential dumping patterns
- Deploy network segmentation: isolate domain controllers, restrict RDP/WinRM to jump servers only
- Implement 3-2-1 backup strategy with offline/immutable backup copies tested monthly
- Deploy external attack surface management (EASM) to identify exposed management interfaces
CVEs associated with SEO Poisoning Supply Chain Campaign Distributing Akira
Weaknesses (CWE) in SEO Poisoning Supply Chain Campaign Distributing Akira
Timeline of SEO Poisoning Supply Chain Campaign Distributing Akira
- Cyjax initially identifies BumbleBee SEO poisoning campaign targeting WinMTR and Milestone XProtect downloads via Bing search results
- Campaign expands to include ManageEngine OpManager, Advanced IP Scanner, ZenMap, and additional enterprise software
- Arctic Wolf observes rapid Akira ransomware deployments targeting unpatched SonicWall SSL VPN devices (CVE-2024-40766) with TTR as fast as 55 minutes
- The DFIR Report publishes initial incident flash alert on SEO poisoning to Akira campaign; Swisscom B2B CSIRT discloses incident in Switzerland
- Darktrace MDR detects SonicWall-based Akira attack with 2GB data exfiltration in ~3 hours; confirms rapid exploitation patterns
- SonicWall releases patch for CVE-2024-40766; however, patch adoption remains low and active exploitation continues globally
- Arctic Wolf and security community reports significant surge in Akira ransomware activity; campaign confirmed as multi-actor operation with 4+ distinct affiliate groups
- The DFIR Report publishes comprehensive technical analysis of November 2025 incident; FBI/CISA joint advisory issued on Akira ransomware
- CNCERT/CC (China) reports 277,800 compromised hosts identified via SEO poisoning campaign in 13-day monitoring window
- Medium article documents broader trend showing 4+ distinct threat actor groups leveraging Bing SEO poisoning for ransomware distribution
- The DFIR Report publishes latest detailed incident report (TL-2026-1004 source material); campaign continues with unabated active exploitation
- Campaign remains ACTIVE with 980+ confirmed victims posted on Akira leak site (Jan-Dec 2025), $244M+ ransoms collected; continued exploitation through June 2026
Update history for TL-2026-1004
- 2026-08-06 — tweetfeed.live community intel: New TL_OSINT_Scan community intel: 2 newly-corroborated indicator(s).
Sources cited for SEO Poisoning Supply Chain Campaign Distributing Akira
- From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira
- From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira (August 2025 Analysis)
- Bing Search Results Weaponized: SEO Poisoning Campaign Distributes Akira Ransomware
- A Sting on Bing: Bumblebee Delivered Through Bing SEO Poisoning Campaign
- When Bing's Organic Search Results Become Phishing Pages
- #StopRansomware: Akira Ransomware - CISA Advisory AA24-109A
- Akira SonicWall Campaign Uncovered - Darktrace
- Smash and Grab: Aggressive Akira Campaign Targets SonicWall VPNs - Arctic Wolf
- Arctic Wolf Observes July 2025 Uptick in Akira Ransomware Activity Targeting SonicWall SSL VPN
- Ongoing Active Exploitation of SonicWall SSL VPNs in Australia (CVE-2024-40766)
- Flight of the Bumblebee: Email Lures and File Sharing Services Lead to Malware - Unit 42 Palo Alto Networks
- Bumblebee Malware Loader Analysis and IOC Indicators
- Fake Zenmap and WinMTR Sites Target IT Staff with Bumblebee Malware
- AdaptixC2 Uncovered: Capabilities, Tactics & Hunting Strategies
- Threat Actors Exploit AdaptixC2, an Emerging Open-Source C2 Tool
Detection coverage for TL-2026-1004
As of 2026-08-06, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1004 across Splunk SPL, Microsoft KQL and Sigma, covering 41 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-1004
1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.