Bumblebee and AdaptixC2 Deliver Akira Ransomware via Bing SEO Poisoning (TB36726/PR40373)
Bumblebee and AdaptixC2 Deliver Akira Ransomware via Bing (TL-2026-1135), also tracked as From Bing Search to Ransomware, is a critical-severity ransomware operation, first published 2026-06-29 and last reviewed 2026-08-06. It is attributed to Akira (Russia) with medium confidence, affects Generic/Multiple Windows Active Directory domain environments, maps to 44 MITRE ATT&CK techniques (T1003.001, T1003.003, T1018), and is covered by 9 detection rules and 58 indicators of compromise.
Key facts for TL-2026-1135
- Threat ID
- TL-2026-1135
- Also known as
- From Bing Search to Ransomware, TB36726, PR40373
- Severity
- CRITICAL
- Status
- ACTIVE
- Category
- RANSOMWARE
- First published
- 2026-06-29
- Last reviewed
- 2026-08-06
- Attribution
- Akira
- Attribution confidence
- MEDIUM
- Nation-state nexus
- Russia
- Motivation
- FINANCIAL
- Target sectors
- small-and-medium-business, education, critical-manufacturing, information-technology, health, financial-services, food-and-agriculture
- Target regions
- North America, Europe, australia
- Detection rules
- 9
- Indicators of compromise
- 58
- Updates
- 2026-08-06
Malware and tooling in Bumblebee and AdaptixC2 Deliver Akira Ransomware via Bing
Malware and tooling: AdaptixC2, Akira, Bumblebee - S1039, FileZilla, RustDesk, SoftPerfect Network Scanner, cloudflared, lsassy
A Bing SEO-poisoning campaign lured users searching for "ManageEngine OpManager," "Advanced IP Scanner," and "Zenmap" to lookalike domains serving a trojanized MSI that side-loaded the Bumblebee loader via a malicious msimg32.dll. Bumblebee deployed an AdaptixC2 beacon for post-exploitation, the actor harvested credentials (NTDS.dit, Veeam PostgreSQL DB, LSASS via lsassy/comsvcs.dll), pivoted via RDP and a reverse SSH tunnel, exfiltrated ~77GB via FileZilla/SFTP to a Ukraine-hosted server, and deployed Akira ransomware (locker.exe) across the root domain approximately 44 hours after initial access, returning via RustDesk two days later to encrypt a child domain controller.
How Bumblebee and AdaptixC2 Deliver Akira Ransomware via Bing works
The DFIR Report (cases TB36726/PR40373, published 2026-06-29) documents a full intrusion chain that began with SEO poisoning of Bing search results for legitimate IT administration and network-scanning tools. Victims searching for "ManageEngine OpManager," "Advanced IP Scanner," and "Zenmap" were funneled through a two-tier infrastructure: impersonation front-end domains (opmanager.pro, ip-scanner.org, zenmap.pro) that redirected to backend delivery gateways (download-center.online, soft-server.online, soft-hub.pro) hosting a trojanized ManageEngine-OpManager.msi signed with a since-revoked "LLC Resource+" certificate.
Executing the MSI dropped files into %TEMP%\ApplicationInstallationFolder_11 and launched the legitimate Windows UAC binary consent.exe, which was hijacked via DLL search-order abuse to load a malicious msimg32.dll -- the Bumblebee loader. Bumblebee performed CIS-region locale geofencing (exiting on 27 excluded locales) before beaconing to a rotating set of 14-character .org DGA domains and hardcoded IPs. Approximately five hours after initial execution, Bumblebee dropped AdgNsy.exe (renamed as WAB.exe, the legitimate Windows Address Book utility) which was reflectively injected with AdaptixC2 shellcode via WmiPrvSE.exe, establishing a beacon to 172.96.137.160 (Shock Hosting) using AdaptixC2's default RC4-encrypted HTTP beacon profile.
Over the following days the actor conducted extensive discovery (whoami, systeminfo, quser, nltest /dclist, nltest /domain_trusts, SPN enumeration, Invoke-ShareFinder, SoftPerfect Network Scanner), pivoted to the domain controller via RDP, and extracted NTDS.dit/SYSTEM/SECURITY hives by abusing wbadmin.exe's local backup function to bypass direct file-locking. Veeam Backup & Replication credentials were harvested by querying the VeeamBackup PostgreSQL database directly via psql.exe and decrypting DPAPI-protected values with a hardcoded salt for legacy Veeam passwords. LSASS memory was dumped across three hosts using the lsassy technique (SMB, WMI, Task Scheduler, and DCOM execution methods) via rundll32.exe invoking comsvcs.dll's MiniDump export, with dump files disguised using randomized names and misleading extensions (.sys, .docx, .avhdx).
Persistence was established through new domain accounts (backup_DA, backup_EA) added to Enterprise Admins, a compromised local Administrator account, and RustDesk installed as a Windows service for remote access. A reverse SSH tunnel to 193.242.184.150 exposed internal RDP (3389) on remote port 10400, enabling RDP-over-SSH bridging and roughly 2.5GB of SYSVOL exfiltration. Approximately 39 hours after initial access, the actor began exfiltrating data via a FileZilla SFTP client (installed via FileZilla_3.68.1_win64_sponsored2-setup.exe, username "Stark") to 185.174.100.203:22, a Ukraine-hosted server on AS-COLOCROSSING, across two sessions totaling ~77GB (39.28GB and 41.77GB), including DPAPI master keys, RSA keys/certificates, Windows Credential Manager stores, browser data, cloud credentials (.aws, gcloud, Azure), password-manager vaults, source-code repositories, and mRemoteNG configs.
Approximately 44 hours after initial compromise, the actor deployed Akira ransomware (locker.exe, e.g. "locker.exe -p=G:\ -n=15") against backup and file servers on the root domain, deleting shadow copies via PowerShell/WMI (Get-WmiObject Win32_Shadowcopy | Remove-WmiObject) roughly one second after each execution. Two days later the actor returned via RustDesk, compromised a child domain controller, enumerated it with Get-ADComputer/Get-ADUser/DNS zone export, and executed Akira 39 additional times. A parallel Swisscom-affiliated incident referenced in the same report showed the actor moving from initial access to ransomware deployment in roughly nine hours, using BYOVD (rwdrv.sys/mgdsrv, hlpdrv.sys/KMHLPSVC) and AV-killer utilities (icardagt.exe, mfpmp.exe) to disable endpoint security, plus Cloudflare Tunnel (cloudflared) for covert remote access and wmic-based mass service/process termination before running a win.exe Akira variant with -n=2 netonly.
Akira is a Ransomware-as-a-Service operation (MITRE ATT&CK Group G1024; aliases GOLD SAHARA, PUNK SPIDER, Howling Scorpius, Storm-1567) active since March 2023, assessed by TRM Labs as likely linked to Russia/the post-Soviet region with possible ties to the defunct Conti/TrickBot ecosystem. AdaptixC2 is a legitimate open-source, Golang/C++Qt red-team post-exploitation framework (public since August 2024) increasingly weaponized by Akira affiliates and other Russian-nexus ransomware crews. Bumblebee is a loader descended from BazarLoader/TrickBot-affiliated development, historically distributed by initial-access-broker groups including ITG23/TA578/TA579/Exotic Lily and used to deliver Cobalt Strike, Meterpreter, and ransomware precursors.
MITRE ATT&CK techniques used in TL-2026-1135
Credential Access
T1003.001 LSASS Memory; T1003.003 NTDS; T1555 Credentials from Password Stores
Discovery
T1018 Remote System Discovery; T1033 System Owner/User Discovery; T1046 Network Service Discovery; T1069.001 Local Groups; T1069.002 Domain Groups; T1082 System Information Discovery; T1083 File and Directory Discovery; T1087.001 Local Account; T1087.002 Domain Account; T1135 Network Share Discovery; T1482 Domain Trust Discovery
Lateral Movement
T1021.001 Remote Desktop Protocol; T1021.003 Distributed Component Object Model
Defense Evasion
T1027.010 Command Obfuscation; T1036 Masquerading; T1055 Process Injection; T1070.004 File Deletion; T1574.001 DLL
Collection
T1039 Data from Network Shared Drive
Exfiltration
T1041 Exfiltration Over C2 Channel; T1048.001 Exfiltration Over Symmetric Encrypted Non-C2 Protocol
Execution
T1047 Windows Management Instrumentation; T1059.001 PowerShell; T1059.003 Windows Command Shell; T1204.002 Malicious File; T1569.002 Service Execution
Privilege Escalation
T1068 Exploitation for Privilege Escalation
Command and Control
T1071.001 Web Protocols; T1090 Proxy; T1219 Remote Access Tools; T1568.002 Domain Generation Algorithms
Persistence
T1136.002 Domain Account; T1543.003 Windows Service; T1547.001 Registry Run Keys / Startup Folder
Initial Access
Impact
T1486 Data Encrypted for Impact; T1490 Inhibit System Recovery
Resource Development
T1583.001 Domains; T1588.002 Tool; T1608.006 SEO Poisoning
defense-impairment
Affected products and versions in Bumblebee and AdaptixC2 Deliver Akira Ransomware via Bing
- Generic/Multiple — Windows Active Directory domain environments
Vulnerable versions: All Windows Server domain controller and member server versions targeted for credential theft and ransomware deployment
Fixed in: N/A - mitigated via hardening and detection, not a patchable vulnerability - Zoho / ManageEngine — OpManager
Vulnerable versions: Brand impersonated via lookalike domain opmanager.pro; the real product itself was not exploited
Fixed in: N/A - Famatech — Advanced IP Scanner
Vulnerable versions: Brand impersonated via lookalike domain ip-scanner.org; the real product itself was not exploited
Fixed in: N/A - Nmap.org — Zenmap
Vulnerable versions: Brand impersonated via lookalike domain zenmap.pro; the real product itself was not exploited
Fixed in: N/A - Veeam — Veeam Backup & Replication
Vulnerable versions: Deployments storing recoverable credentials in the VeeamBackup PostgreSQL database
Fixed in: N/A - targeted for credential extraction, not a Veeam software vulnerability
Remediation for Bumblebee and AdaptixC2 Deliver Akira Ransomware via Bing
Patches
- No CVE/software vulnerability was exploited in this campaign; ensure ManageEngine OpManager, Advanced IP Scanner, and Nmap/Zenmap are obtained only from official vendor download pages
- Apply current Veeam Backup & Replication hardening guidance to reduce exposure of the credentials database
Immediate actions
- Block all identified IOC domains and IPs at DNS/proxy/firewall layer, including the Bumblebee DGA .org domains, AdaptixC2 C2 IP, and the FileZilla exfil destination 185.174.100.203
- Hunt for msimg32.dll (or other side-loadable system DLLs) present outside System32 and co-located with consent.exe or other signed UAC binaries
- Audit Active Directory for unexpected domain accounts (e.g. backup_DA, backup_EA) or unexpected additions to Enterprise Admins/Domain Admins and disable/reset immediately
- Hunt for and terminate rundll32.exe invocations of comsvcs.dll with the MiniDump export against lsass.exe, and for wbadmin.exe backups targeting NTDS.dit/SYSTEM/SECURITY
- Identify and remove unauthorized RustDesk, cloudflared, or other remote-access tool installations, especially those registered as Windows services
- Rotate all credentials stored in the Veeam Backup & Replication PostgreSQL credentials database and review Veeam DPAPI-protected password usage
- Review and restrict outbound SSH (port 22) and reverse tunneling from server/workstation VLANs to the internet
Workarounds
- Enforce MFA on all remote access paths (RDP, VPN, RustDesk, cloudflared) and disable direct internet-facing RDP
- Restrict wbadmin.exe usage and WMI/vssadmin shadow-copy deletion capability to authorized backup-admin accounts via GPO/AppLocker
- Block outbound SSH from server and workstation network segments except through approved, monitored jump hosts
Longer-term hardening
- Deploy EDR/XDR with behavioral detection tuned for LSASS access, comsvcs.dll dumping, DLL side-loading, and reflective shellcode injection into legitimate processes
- Implement application allowlisting/WDAC to prevent execution of unsigned or side-loaded DLLs alongside trusted system binaries
- Segment backup infrastructure and domain controllers from general user/workstation network segments
- Deploy DNS filtering/RPZ against newly-registered domains and DGA-pattern indicators
- Run purple-team exercises emulating Bumblebee/AdaptixC2/Akira TTPs against current detection coverage
- Deliver user-awareness training on verifying software downloads only from official vendor domains rather than search-engine results
Weaknesses (CWE) in Bumblebee and AdaptixC2 Deliver Akira Ransomware via Bing
CWE-494, CWE-506
Timeline of Bumblebee and AdaptixC2 Deliver Akira Ransomware via Bing
- Approximately five hours after initial execution, Bumblebee drops AdgNsy.exe (renamed WAB.exe), reflectively injected with AdaptixC2 shellcode via WmiPrvSE.exe; the beacon calls out to 172.96.137.160 and the actor runs initial discovery commands (whoami, systeminfo, quser, nltest).
- Victim searches Bing for ManageEngine OpManager, is redirected through opmanager.pro and a delivery gateway to a trojanized ManageEngine-OpManager.msi; executing it launches consent.exe which side-loads the malicious msimg32.dll (Bumblebee loader) at approximately 05:00 UTC.
- Day two: actor pivots via RDP to the domain controller and extracts NTDS.dit, SYSTEM, and SECURITY hives using a wbadmin.exe local-backup trick; Veeam Backup & Replication credentials are dumped from the PostgreSQL VeeamBackup database and DPAPI-decrypted.
- Approximately 39 hours after initial access, the actor (username "Stark") begins FileZilla SFTP exfiltration to 185.174.100.203:22; the first session transfers 39.28GB over 4.5 hours.
- A reverse SSH tunnel is established to 193.242.184.150 (ssh -R *:10400 -p22), exposing internal RDP (3389) on remote port 10400 and enabling RDP-over-SSH bridging; roughly 2.5GB of SYSVOL data is exfiltrated over the tunnel.
- Day three: LSASS memory is dumped across three hosts via rundll32.exe/comsvcs.dll (lsassy technique, using SMB/WMI/Task Scheduler/DCOM execution); domain accounts backup_DA and backup_EA are created and backup_EA is added to Enterprise Admins.
- Approximately 44 hours after initial compromise, Akira ransomware (locker.exe) is deployed against backup and file servers on the root domain (e.g. locker.exe -p=G:\ -n=15); shadow copies are deleted via PowerShell/WMI roughly one second after each execution.
- A second FileZilla SFTP session transfers 41.77GB over 4.6 hours, bringing total exfiltrated data to approximately 77GB, including credential stores, browser data, cloud credentials, password-manager vaults, and source code.
- Day five (two days after the root-domain encryption): the actor returns via RustDesk, compromises a child domain controller, enumerates it with Get-ADComputer/Get-ADUser and DNS zone export, and executes Akira 39 additional times.
- The DFIR Report publishes the full technical writeup (cases TB36726/PR40373); Malpedia indexes the campaign the same day. The report states the intrusion itself occurred in July 2025, with the days below numbered relative to initial access.
Update history for TL-2026-1135
- 2026-08-06 — tweetfeed.live community intel: New TL_OSINT_Scan community intel: 2 newly-corroborated indicator(s).
Sources cited for Bumblebee and AdaptixC2 Deliver Akira Ransomware via Bing
- From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira
- Malpedia library entry: From Bing Search to Ransomware
- MITRE ATT&CK Group G1024 - Akira
- #StopRansomware: Akira Ransomware (AA24-109A)
- CISA and Partners Release Advisory Update on Akira Ransomware
- #StopRansomware: Akira Ransomware (Joint CSA update)
- Akira Ransomware Group: Threat Profile and TTPs
- AdaptixC2: A New Open-Source Framework Leveraged in Real-World Attacks
- Russian Ransomware Gangs Weaponize Open-Source AdaptixC2 for Advanced Attacks
- Open-source AdaptixC2 hacking tool has fans in Russian cybercrime underground
- AdaptixC2 Framework (GitHub repository)
- Akira Ransomware Threat Actor Profile - Tactics, Techniques, and Updates
- New Bumblebee malware replaces Conti's BazarLoader in cyberattacks
- Bumblebee Loader
- New malware loader Bumblebee adopted by known ransomware access brokers
Threats related to Bumblebee and AdaptixC2 Deliver Akira Ransomware via Bing
- SEO Poisoning Supply Chain Campaign Distributing Akira Ransomware via Trojanized Enterprise Software
- Akira Ransomware Kill Chain — SSLVPN Credential Stuffing → Kerberoasting → RDP Lateral → vssadmin Shadow Copy Deletion (SANS ISC Forensic Reconstruction, May 2026)
- The Gentlemen Ransomware: Worm-Like Self-Propagation and Network-Wide Encryption via Storm-2697's RaaS Affiliate Program
- Akira Ransomware Affiliate Forces Windows Safe Mode Reboot to Disable EDR, Exfiltrates Data via AnyDesk/WinRAR/s5cmd but Fails to Encrypt
- Proofpoint AI Era Ransomware Report: 37% of Paying Victims Face Repeat Extortion Demands
- Anubis Ransomware Group Confirms Data Theft in Coca-Cola Fairlife Attack Tied to CitrixBleed 2 (CVE-2025-5777) Exploitation Wave
Detection coverage for TL-2026-1135
As of 2026-08-06, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1135 across Splunk SPL, Microsoft KQL and Sigma, covering 58 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-1135
1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.