# SEO Poisoning Supply Chain Campaign Distributing Akira Ransomware via Trojanized Enterprise Software

> Multi-threat-actor SEO poisoning campaign targets enterprise IT administrators through Bing search results, distributing trojanized ManageEngine OpManager, ZenMap, WinMTR, and other network tools. Infection chain: BumbleBee loader → AdaptixC2 C2 beacon → credential theft/lateral movement → 75GB+ exfiltration → Akira ransomware deployment in 9-44 hours. Active since May 2025 with 980+ confirmed victims and $244M+ in collected ransom.

- **Published:** 2026-06-30T14:20:00Z
- **Last reviewed:** 2026-08-06T18:51:31Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1004
- **ID:** TL-2026-1004
- **Severity:** CRITICAL
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Akira Ransomware Gang (Russia)
- **Detections:** 9 · **IOCs:** 41 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2024-40766

## Description

This is an exceptionally high-impact, ongoing supply chain compromise campaign leveraging search engine manipulation to distribute malware at enterprise scale. Threat actors have poisoned Bing organic search results for legitimate software keywords (ManageEngine OpManager, ZenMap, WinMTR, Advanced IP Scanner, Milestone XProtect, PulseSecure, SonicWall), presenting cloned legitimate websites that redirect to malicious download servers hosting trojanized MSI installers. When executed by unsuspecting IT administrators, the installer triggers a sophisticated multi-stage attack: BumbleBee malware loader executes via DLL sideloading (msimg32.dll hijacking consent.exe), immediately reaching out to command servers. Within 5 hours, AdaptixC2 C2 beacon deploys, enabling reconnaissance and remote code execution. Over Days 1-3, attackers conduct comprehensive network mapping, extract domain credentials (NTDS.dit dumps, LSASS memory, Veeam database credentials), create backdoor admin accounts (backup_DA, backup_EA), and deploy RustDesk for persistent remote access. Concurrent with lateral movement, attackers exfiltrate 75GB+ of sensitive data via SFTP to external infrastructure (185.174.100.203, 193.242.184.150) in parallel sessions. Finally, Akira ransomware deploys across the network, encrypting critical systems and threatening public data release (double extortion). Time-to-ransom ranges from 9 hours (fastest observed) to 44 hours. Campaign is active across multiple threat actor groups (4+ confirmed), targeting manufacturing, construction, engineering, healthcare, and critical infrastructure sectors globally. Total confirmed victims: 980+ (Jan-Dec 2025), with 277,800 compromised hosts identified in 13-day window (December 2025). Total ransom collected: $244M+ through 2025.

## MITRE ATT&CK

- T1189 Drive-by Compromise
- T1566 Phishing
- T1204 User Execution
- T1218 System Binary Proxy Execution
- T1059 Command and Scripting Interpreter
- T1543 Create or Modify System Process
- T1547 Boot or Logon Autostart Execution
- T1053 Scheduled Task/Job
- T1548 Abuse Elevation Control Mechanism
- T1574 Hijack Execution Flow
- T1036 Masquerading
- T1027 Obfuscated Files or Information
- T1055 Process Injection
- T1685 Disable or Modify Tools
- T1070 Indicator Removal
- T1003 OS Credential Dumping
- T1555 Credentials from Password Stores
- T1082 System Information Discovery
- T1046 Network Service Discovery
- T1087 Account Discovery
- T1069 Permission Groups Discovery
- T1570 Lateral Tool Transfer
- T1021 Remote Services
- T1550 Use Alternate Authentication Material
- T1005 Data from Local System
- T1039 Data from Network Shared Drive
- T1074 Data Staged
- T1071 Application Layer Protocol
- T1573 Encrypted Channel
- T1568 Dynamic Resolution
- T1041 Exfiltration Over C2 Channel
- T1048 Exfiltration Over Alternative Protocol
- T1486 Data Encrypted for Impact
- T1490 Inhibit System Recovery

## Sources

- [From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira](https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/)
- [From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira (August 2025 Analysis)](https://thedfirreport.com/2025/08/05/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira/)
- [Bing Search Results Weaponized: SEO Poisoning Campaign Distributes Akira Ransomware](https://cybersecuritynews.com/bing-search-for-manageengine-opmanager/)
- [A Sting on Bing: Bumblebee Delivered Through Bing SEO Poisoning Campaign](https://www.cyjax.com/resources/blog/a-sting-on-bing-bumblebee-delivered-through-bing-seo-poisoning-campaign)
- [When Bing's Organic Search Results Become Phishing Pages](https://alluresecurity.com/blog/bing-seo-poisoning-brand-impersonation/)
- [#StopRansomware: Akira Ransomware - CISA Advisory AA24-109A](https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-109a)
- [Akira SonicWall Campaign Uncovered - Darktrace](https://www.darktrace.com/blog/inside-akiras-sonicwall-campaign-darktraces-detection-and-response/)
- [Smash and Grab: Aggressive Akira Campaign Targets SonicWall VPNs - Arctic Wolf](https://arcticwolf.com/resources/blog/smash-and-grab-aggressive-akira-campaign-targets-sonicwall-vpns-deploys-ransomware-in-an-hour-or-less/)
- [Arctic Wolf Observes July 2025 Uptick in Akira Ransomware Activity Targeting SonicWall SSL VPN](https://arcticwolf.com/resources/blog/arctic-wolf-observes-july-2025-uptick-in-akira-ransomware-activity-targeting-sonicwall-ssl-vpn/)
- [Ongoing Active Exploitation of SonicWall SSL VPNs in Australia (CVE-2024-40766)](https://www.cyber.gov.au/about-us/view-all-content/alerts-and-advisories/ongoing-active-exploitation-of-sonicwall-ssl-vpns-in-australia)
- [Flight of the Bumblebee: Email Lures and File Sharing Services Lead to Malware - Unit 42 Palo Alto Networks](https://unit42.paloaltonetworks.com/bumblebee-malware-projector-libra/)
- [Bumblebee Malware Loader Analysis and IOC Indicators](https://www.bleepingcomputer.com/news/security/bumblebee-malware-distributed-via-zenmap-winmrt-seo-poisoning/)
- [AdaptixC2 Uncovered: Capabilities, Tactics & Hunting Strategies](https://hunt.io/blog/adaptixc2-uncovered-capabilities-tactics-hunting)
- [Threat Actors Exploit AdaptixC2, an Emerging Open-Source C2 Tool](https://www.rescana.com/post/adaptixc2-under-fire-russian-ransomware-gangs-weaponize-open-source-c2-framework-for-advanced-attac)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1004