# Bumblebee and AdaptixC2 Deliver Akira Ransomware via Bing SEO Poisoning (TB36726/PR40373)

> A Bing SEO-poisoning campaign lured users searching for "ManageEngine OpManager," "Advanced IP Scanner," and "Zenmap" to lookalike domains serving a trojanized MSI that side-loaded the Bumblebee loader via a malicious msimg32.dll. Bumblebee deployed an AdaptixC2 beacon for post-exploitation, the actor harvested credentials (NTDS.dit, Veeam PostgreSQL DB, LSASS via lsassy/comsvcs.dll), pivoted via RDP and a reverse SSH tunnel, exfiltrated ~77GB via FileZilla/SFTP to a Ukraine-hosted server, and deployed Akira ransomware (locker.exe) across the root domain approximately 44 hours after initial access, returning via RustDesk two days later to encrypt a child domain controller.

- **Published:** 2026-06-29T00:00:00Z
- **Last reviewed:** 2026-08-06T18:51:35Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1135
- **ID:** TL-2026-1135
- **Severity:** CRITICAL
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Akira (Russia)
- **Detections:** 9 · **IOCs:** 58 (full data via the Threadlinqs MCP server — Purple tier)

## Description

The DFIR Report (cases TB36726/PR40373, published 2026-06-29) documents a full intrusion chain that began with SEO poisoning of Bing search results for legitimate IT administration and network-scanning tools. Victims searching for "ManageEngine OpManager," "Advanced IP Scanner," and "Zenmap" were funneled through a two-tier infrastructure: impersonation front-end domains (opmanager.pro, ip-scanner.org, zenmap.pro) that redirected to backend delivery gateways (download-center.online, soft-server.online, soft-hub.pro) hosting a trojanized ManageEngine-OpManager.msi signed with a since-revoked "LLC Resource+" certificate.

Executing the MSI dropped files into %TEMP%\ApplicationInstallationFolder_11 and launched the legitimate Windows UAC binary consent.exe, which was hijacked via DLL search-order abuse to load a malicious msimg32.dll -- the Bumblebee loader. Bumblebee performed CIS-region locale geofencing (exiting on 27 excluded locales) before beaconing to a rotating set of 14-character .org DGA domains and hardcoded IPs. Approximately five hours after initial execution, Bumblebee dropped AdgNsy.exe (renamed as WAB.exe, the legitimate Windows Address Book utility) which was reflectively injected with AdaptixC2 shellcode via WmiPrvSE.exe, establishing a beacon to 172.96.137.160 (Shock Hosting) using AdaptixC2's default RC4-encrypted HTTP beacon profile.

Over the following days the actor conducted extensive discovery (whoami, systeminfo, quser, nltest /dclist, nltest /domain_trusts, SPN enumeration, Invoke-ShareFinder, SoftPerfect Network Scanner), pivoted to the domain controller via RDP, and extracted NTDS.dit/SYSTEM/SECURITY hives by abusing wbadmin.exe's local backup function to bypass direct file-locking. Veeam Backup & Replication credentials were harvested by querying the VeeamBackup PostgreSQL database directly via psql.exe and decrypting DPAPI-protected values with a hardcoded salt for legacy Veeam passwords. LSASS memory was dumped across three hosts using the lsassy technique (SMB, WMI, Task Scheduler, and DCOM execution methods) via rundll32.exe invoking comsvcs.dll's MiniDump export, with dump files disguised using randomized names and misleading extensions (.sys, .docx, .avhdx).

Persistence was established through new domain accounts (backup_DA, backup_EA) added to Enterprise Admins, a compromised local Administrator account, and RustDesk installed as a Windows service for remote access. A reverse SSH tunnel to 193.242.184.150 exposed internal RDP (3389) on remote port 10400, enabling RDP-over-SSH bridging and roughly 2.5GB of SYSVOL exfiltration. Approximately 39 hours after initial access, the actor began exfiltrating data via a FileZilla SFTP client (installed via FileZilla_3.68.1_win64_sponsored2-setup.exe, username "Stark") to 185.174.100.203:22, a Ukraine-hosted server on AS-COLOCROSSING, across two sessions totaling ~77GB (39.28GB and 41.77GB), including DPAPI master keys, RSA keys/certificates, Windows Credential Manager stores, browser data, cloud credentials (.aws, gcloud, Azure), password-manager vaults, source-code repositories, and mRemoteNG configs.

Approximately 44 hours after initial compromise, the actor deployed Akira ransomware (locker.exe, e.g. "locker.exe -p=G:\ -n=15") against backup and file servers on the root domain, deleting shadow copies via PowerShell/WMI (Get-WmiObject Win32_Shadowcopy | Remove-WmiObject) roughly one second after each execution. Two days later the actor returned via RustDesk, compromised a child domain controller, enumerated it with Get-ADComputer/Get-ADUser/DNS zone export, and executed Akira 39 additional times. A parallel Swisscom-affiliated incident referenced in the same report showed the actor moving from initial access to ransomware deployment in roughly nine hours, using BYOVD (rwdrv.sys/mgdsrv, hlpdrv.sys/KMHLPSVC) and AV-killer utilities (icardagt.exe, mfpmp.exe) to disable endpoint security, plus Cloudflare Tunnel (cloudflared) for covert remote access and wmic-based mass service/process termination before running a win.exe Akira variant with -n=2 netonly.

Akira is a Ransomware-as-a-Service operation (MITRE ATT&CK Group G1024; aliases GOLD SAHARA, PUNK SPIDER, Howling Scorpius, Storm-1567) active since March 2023, assessed by TRM Labs as likely linked to Russia/the post-Soviet region with possible ties to the defunct Conti/TrickBot ecosystem. AdaptixC2 is a legitimate open-source, Golang/C++Qt red-team post-exploitation framework (public since August 2024) increasingly weaponized by Akira affiliates and other Russian-nexus ransomware crews. Bumblebee is a loader descended from BazarLoader/TrickBot-affiliated development, historically distributed by initial-access-broker groups including ITG23/TA578/TA579/Exotic Lily and used to deliver Cobalt Strike, Meterpreter, and ransomware precursors.

## MITRE ATT&CK

- T1608.006 SEO Poisoning
- T1583.001 Domains
- T1588.002 Tool
- T1189 Drive-by Compromise
- T1204.002 Malicious File
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1047 Windows Management Instrumentation
- T1569.002 Service Execution
- T1543.003 Windows Service
- T1136.002 Domain Account
- T1547.001 Registry Run Keys / Startup Folder
- T1068 Exploitation for Privilege Escalation
- T1574.001 DLL
- T1055 Process Injection
- T1036 Masquerading
- T1027.010 Command Obfuscation
- T1070.004 File Deletion
- T1685 Disable or Modify Tools
- T1003.001 LSASS Memory
- T1003.003 NTDS
- T1555 Credentials from Password Stores
- T1018 Remote System Discovery
- T1046 Network Service Discovery
- T1135 Network Share Discovery
- T1082 System Information Discovery
- T1033 System Owner/User Discovery
- T1083 File and Directory Discovery
- T1087.001 Local Account
- T1087.002 Domain Account
- T1069.001 Local Groups
- T1069.002 Domain Groups
- T1482 Domain Trust Discovery
- T1021.001 Remote Desktop Protocol
- T1021.003 Distributed Component Object Model
- T1039 Data from Network Shared Drive
- T1071.001 Web Protocols
- T1090 Proxy
- T1568.002 Domain Generation Algorithms
- T1219 Remote Access Tools

## Sources

- [From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira](https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/)
- [Malpedia library entry: From Bing Search to Ransomware](https://malpedia.caad.fkie.fraunhofer.de/library/b134a48b-0d93-4aa1-b234-a21f20b2cedd/)
- [MITRE ATT&CK Group G1024 - Akira](https://attack.mitre.org/groups/G1024/)
- [#StopRansomware: Akira Ransomware (AA24-109A)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-109a)
- [CISA and Partners Release Advisory Update on Akira Ransomware](https://www.cisa.gov/news-events/alerts/2025/11/13/cisa-and-partners-release-advisory-update-akira-ransomware)
- [#StopRansomware: Akira Ransomware (Joint CSA update)](https://www.ic3.gov/CSA/2025/251113.pdf)
- [Akira Ransomware Group: Threat Profile and TTPs](https://www.trmlabs.com/resources/intel-library/akira)
- [AdaptixC2: A New Open-Source Framework Leveraged in Real-World Attacks](https://unit42.paloaltonetworks.com/adaptixc2-post-exploitation-framework/)
- [Russian Ransomware Gangs Weaponize Open-Source AdaptixC2 for Advanced Attacks](https://thehackernews.com/2025/10/russian-ransomware-gangs-weaponize-open.html)
- [Open-source AdaptixC2 hacking tool has fans in Russian cybercrime underground](https://therecord.media/open-source-adaptixc2-red-teaming-tool-russian-cybercrime)
- [AdaptixC2 Framework (GitHub repository)](https://github.com/Adaptix-Framework/AdaptixC2)
- [Akira Ransomware Threat Actor Profile - Tactics, Techniques, and Updates](https://www.huntress.com/threat-library/threat-actors/akira)
- [New Bumblebee malware replaces Conti's BazarLoader in cyberattacks](https://www.bleepingcomputer.com/news/security/new-bumblebee-malware-replaces-contis-bazarloader-in-cyberattacks/)
- [Bumblebee Loader](https://www.intel471.com/blog/bumblebee-loader)
- [New malware loader Bumblebee adopted by known ransomware access brokers](https://www.csoonline.com/article/572665/new-malware-loader-bumblebee-adopted-by-known-ransomware-access-brokers.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1135