Threat reportRansomwareTL-2026-4440
From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira
From Bing Search to Ransomware (TL-2026-4440) is a high-severity ransomware operation, first published 2026-10-26. It has no confirmed attribution, affects Microsoft Windows Server / Active Directory environments, maps to 21 MITRE ATT&CK techniques (T1003.001, T1003.003, T1018), and is covered by 9 detection rules and 30 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 21MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 30Indicators of compromise
Key facts for TL-2026-4440
- Threat ID
- TL-2026-4440
- Severity
- HIGH
- Status
- ACTIVE
- Category
- RANSOMWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- unspecified
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 30
Malware and tooling in From Bing Search to Ransomware
Malware and tooling: AdaptixC2, Bumblebee - S1039, RustDesk
How From Bing Search to Ransomware works
SEO poisoning of Bing results for "ManageEngine OpManager" led an IT administrator to the lookalike domain opmanager.pro and a trojanized MSI that side-loaded the BumbleBee loader. The intruders then deployed an AdaptixC2 beacon, harvested credentials, exfiltrated about 77 GB over SFTP and deployed Akira ransomware roughly 44 hours after initial access.
The DFIR Report documents a ransomware intrusion that began when an IT administrator searched Bing for "ManageEngine OpManager" and followed a poisoned result to the lookalike domain opmanager.pro. The site served a trojanized ManageEngine-OpManager.msi. The MSI staged a legitimate consent.exe in %TEMP%\ApplicationInstallationFolder_11 next to a malicious msimg32.dll, the BumbleBee loader, which is launched through DLL side-loading. BumbleBee contacted its command-and-control over HTTPS using domain-generation-algorithm domains (14-character .org names in this wave), with payload delivery and C2 observed on IPs such as 109.205.195.211 and 188.40.187.145. Related waves reported by the same source impersonated other administrator tools: WinMTR, Zenmap, RVTools and Milestone XProtect in May 2025 (version.dll side-loaded via icardagt.exe, 13-character .life DGA domains), and ManageEngine OpManager, Advanced IP Scanner and MIB Browser in July 2025.
About five hours after the infection an AdaptixC2 beacon was deployed. Its shellcode was injected into AdgNsy.exe, a renamed WAB.exe, and the beacon called back over HTTP to 172.96.137.160 (Shock Hosting), with WmiPrvSE.exe seen as the parent process. The operators ran discovery with SoftPerfect Network Scanner and native commands, escalated to Enterprise Administrator, dumped LSASS (lsassy; comsvcs.dll memory dump) and extracted NTDS.dit with wbadmin.exe. They also targeted DPAPI master keys, browser data, cloud credentials (AWS, Azure, Google Cloud) and Veeam credential stores. Persistence and remote access used RustDesk installed as a Windows service on file and backup servers, plus a reverse SSH tunnel (ssh -R) that proxied RDP and carried about 2.5 GB of SYSVOL data to 193.242.184.150.
Main data theft used FileZilla (delivered through the RDP clipboard) over SFTP to 185.174.100.203 (Ukraine, AS-COLOCROSSING), about 77 GB in two sessions (39.28 GB and 41.77 GB). Akira ransomware (locker.exe, staged in C:\ProgramData) was executed about 44 hours after initial access, run as -p=G:\ -n=15. It encrypted the backup server, file server and domain controller, and then the child domain on day 5. 39 separate executions were seen on the child domain controller, and the actors re-entered via RustDesk. Shadow copies were deleted with PowerShell (Get-WmiObject Win32_Shadowcopy | Remove-WmiObject). A second, related case investigated with the Swisscom B2B CSIRT showed AdaptixC2, BYOVD drivers (rwdrv.sys as service mgdsrv, hlpdrv.sys as service KMHLPSVC), Cloudflared tunnelling, WMIC termination of SQL and IIS services, and Akira (win.exe, -n=2 netonly) deployed about 9 hours in.
No CVE is involved; the intrusion relies on user execution of a poisoned download. The source does not state the victim sector and the activity is not attributed to a named actor; the tradecraft is consistent with financially motivated Akira ransomware affiliates. Severity HIGH is an analyst assessment (full domain-wide encryption, large-scale exfiltration); the report does not state a severity.
MITRE ATT&CK techniques used in TL-2026-4440
Credential Access
T1003.001 OS Credential Dumping: LSASS Memory; T1003.003 OS Credential Dumping: NTDS
Discovery
T1018 Remote System Discovery; T1046 Network Service Discovery; T1482 Domain Trust Discovery
Lateral Movement
T1021.001 Remote Services: Remote Desktop Protocol
Defense Evasion
T1036 Masquerading; T1055 Process Injection; T1574.001 DLL
Execution
T1047 Windows Management Instrumentation; T1059.001 Command and Scripting Interpreter: PowerShell; T1204.002 User Execution: Malicious File; T1569.002 System Services: Service Execution
Exfiltration
Command and Control
T1071.001 Application Layer Protocol: Web Protocols; T1219 Remote Access Tools; T1568.002 Dynamic Resolution: Domain Generation Algorithms; T1572 Protocol Tunneling
Impact
Persistence
T1543.003 Create or Modify System Process: Windows Service
defense-impairment
Affected products and versions in From Bing Search to Ransomware
- Microsoft — Windows Server / Active Directory environments
Vulnerable versions: Not version-specific; abuse of legitimate functionality - Zoho ManageEngine — OpManager (brand impersonated by a trojanized installer; the product itself is not vulnerable)
Remediation for From Bing Search to Ransomware
Immediate actions
- Block the listed domains and IPs at DNS, proxy and firewall, and hunt for msimg32.dll loaded from %TEMP%\ApplicationInstallationFolder_* by consent.exe
- Hunt for unsanctioned RustDesk, Cloudflared, FileZilla and outbound ssh -R reverse tunnels on servers
- Reset credentials (including krbtgt and privileged accounts) if NTDS.dit extraction via wbadmin.exe or LSASS dumping is found
- Isolate backup, file and domain controller hosts showing WMI-based remote execution or Win32_Shadowcopy removal
Workarounds
- Block newly registered and lookalike domains for administrator tooling
- Disable or restrict WMI remote execution and RDP between server tiers
Longer-term hardening
- Restrict software downloads to vendor-verified sources and an internal software catalog; verify domains and code-signing before installing admin tools
- Use application allow-listing to prevent DLL side-loading from user-writable paths
- Isolate and harden backup infrastructure (including Veeam credential stores) and keep offline or immutable copies
- Alert on large outbound SFTP/SSH transfers and on new Windows services installing remote-access tools
- Enable the vulnerable-driver blocklist to counter BYOVD
Timeline of From Bing Search to Ransomware
- Wave 1 of the BumbleBee SEO-poisoning campaign (May 2025; exact day not stated) impersonated WinMTR, Zenmap, RVTools and Milestone XProtect via download-server.online and soft-server.online, side-loading version.dll via icardagt.exe and using 13-character .life DGA domains.
- About 5 hours after infection an AdaptixC2 beacon (shellcode injected into AdgNsy.exe, a renamed WAB.exe) was deployed, calling back to 172.96.137.160.
- T+0 (July 2025): an IT administrator searching Bing for ManageEngine OpManager reached opmanager.pro and ran the trojanized MSI, which launched consent.exe and the BumbleBee msimg32.dll loader.
- Wave 2 (July 2025; exact day not stated) impersonated ManageEngine OpManager, Advanced IP Scanner and MIB Browser via download-center.online and soft-hub.pro, side-loading msimg32.dll via consent.exe with 14-character .org DGA domains.
- Day 2: lateral movement to the domain controller, privilege escalation to Enterprise Administrator, NTDS.dit extraction via wbadmin.exe and LSASS dumping.
- About 44 hours after initial access Akira ransomware (locker.exe, -p=G:\ -n=15) was executed against the backup server, file server and domain controller; shadow copies were removed via WMI.
- Day 3: reverse SSH tunnel established (about 2.5 GB, mainly SYSVOL, to 193.242.184.150) and FileZilla SFTP exfiltration to 185.174.100.203 began (about 77 GB in two sessions).
- Day 5: the actors re-entered via RustDesk and encrypted the child domain (39 executions on the child domain controller).
- The DFIR Report published its analysis of the intrusion, including IOCs, with the Swisscom B2B CSIRT contributing a related case.
Sources cited for From Bing Search to Ransomware
- From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira
- Bumblebee Malware Resurfaces in Campaigns to Deploy Akira Ransomware (Anvilogic)
- How Do Fake ManageEngine OpManager Downloads Deliver BumbleBee Malware and Akira Ransomware (ProArch)
- BumbleBee and AdaptixC2 Deliver Akira Ransomware via Bing SEO (TechNadu)
- Bing Search for ManageEngine OpManager Led to Akira Ransomware Attack (VPNCentral)
- From bing search to ransomware: bumblebee and adaptixc2 deliver akira (Gurucul)
- Threat brief: From Bing Search to Ransomware (Vega)
Detection coverage for TL-2026-4440
As of 2026-10-26, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4440 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-4440
4 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.