# From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira

> SEO poisoning of Bing results for "ManageEngine OpManager" led an IT administrator to the lookalike domain opmanager.pro and a trojanized MSI that side-loaded the BumbleBee loader. The intruders then deployed an AdaptixC2 beacon, harvested credentials, exfiltrated about 77 GB over SFTP and deployed Akira ransomware roughly 44 hours after initial access.

- **Published:** 2026-10-26T09:19:15Z
- **Last reviewed:** 2026-10-26T10:08:35.293Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4440
- **ID:** TL-2026-4440
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 40 (full data via the Threadlinqs MCP server — Purple tier)

## Description

The DFIR Report documents a ransomware intrusion that began when an IT administrator searched Bing for "ManageEngine OpManager" and followed a poisoned result to the lookalike domain opmanager.pro. The site served a trojanized ManageEngine-OpManager.msi. The MSI staged a legitimate consent.exe in %TEMP%\ApplicationInstallationFolder_11 next to a malicious msimg32.dll, the BumbleBee loader, which is launched through DLL side-loading. BumbleBee contacted its command-and-control over HTTPS using domain-generation-algorithm domains (14-character .org names in this wave), with payload delivery and C2 observed on IPs such as 109.205.195.211 and 188.40.187.145. Related waves reported by the same source impersonated other administrator tools: WinMTR, Zenmap, RVTools and Milestone XProtect in May 2025 (version.dll side-loaded via icardagt.exe, 13-character .life DGA domains), and ManageEngine OpManager, Advanced IP Scanner and MIB Browser in July 2025.

About five hours after the infection an AdaptixC2 beacon was deployed. Its shellcode was injected into AdgNsy.exe, a renamed WAB.exe, and the beacon called back over HTTP to 172.96.137.160 (Shock Hosting), with WmiPrvSE.exe seen as the parent process. The operators ran discovery with SoftPerfect Network Scanner and native commands, escalated to Enterprise Administrator, dumped LSASS (lsassy; comsvcs.dll memory dump) and extracted NTDS.dit with wbadmin.exe. They also targeted DPAPI master keys, browser data, cloud credentials (AWS, Azure, Google Cloud) and Veeam credential stores. Persistence and remote access used RustDesk installed as a Windows service on file and backup servers, plus a reverse SSH tunnel (ssh -R) that proxied RDP and carried about 2.5 GB of SYSVOL data to 193.242.184.150.

Main data theft used FileZilla (delivered through the RDP clipboard) over SFTP to 185.174.100.203 (Ukraine, AS-COLOCROSSING), about 77 GB in two sessions (39.28 GB and 41.77 GB). Akira ransomware (locker.exe, staged in C:\ProgramData) was executed about 44 hours after initial access, run as -p=G:\ -n=15. It encrypted the backup server, file server and domain controller, and then the child domain on day 5. 39 separate executions were seen on the child domain controller, and the actors re-entered via RustDesk. Shadow copies were deleted with PowerShell (Get-WmiObject Win32_Shadowcopy | Remove-WmiObject). A second, related case investigated with the Swisscom B2B CSIRT showed AdaptixC2, BYOVD drivers (rwdrv.sys as service mgdsrv, hlpdrv.sys as service KMHLPSVC), Cloudflared tunnelling, WMIC termination of SQL and IIS services, and Akira (win.exe, -n=2 netonly) deployed about 9 hours in.

No CVE is involved; the intrusion relies on user execution of a poisoned download. The source does not state the victim sector and the activity is not attributed to a named actor; the tradecraft is consistent with financially motivated Akira ransomware affiliates. Severity HIGH is an analyst assessment (full domain-wide encryption, large-scale exfiltration); the report does not state a severity.

## MITRE ATT&CK

- T1204.002 User Execution: Malicious File
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1047 Windows Management Instrumentation
- T1569.002 System Services: Service Execution
- T1543.003 Create or Modify System Process: Windows Service
- T1574.001 DLL
- T1055 Process Injection
- T1036 Masquerading
- T1685 Disable or Modify Tools
- T1003.001 OS Credential Dumping: LSASS Memory
- T1003.003 OS Credential Dumping: NTDS
- T1482 Domain Trust Discovery
- T1018 Remote System Discovery
- T1046 Network Service Discovery
- T1021.001 Remote Services: Remote Desktop Protocol
- T1568.002 Dynamic Resolution: Domain Generation Algorithms
- T1071.001 Application Layer Protocol: Web Protocols
- T1219 Remote Access Tools
- T1572 Protocol Tunneling
- T1048.001 Exfiltration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted Non-C2 Protocol
- T1490 Inhibit System Recovery
- T1583.001 Acquire Infrastructure: Domains
- T1608.006 Stage Capabilities: SEO Poisoning
- T1189 Drive-by Compromise
- T1218.011 System Binary Proxy Execution: Rundll32
- T1136.002 Create Account: Domain Account
- T1555 Credentials from Password Stores
- T1087.002 Account Discovery: Domain Account
- T1486 Data Encrypted for Impact

## Sources

- [From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira](https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/)
- [Bumblebee Malware Resurfaces in Campaigns to Deploy Akira Ransomware (Anvilogic)](https://www.anvilogic.com/threat-reports/bumblebee-akira-campaigns)
- [How Do Fake ManageEngine OpManager Downloads Deliver BumbleBee Malware and Akira Ransomware (ProArch)](https://www.proarch.com/blog/threats-vulnerabilities/fake-manageengine-opmanager-downloads-akira-ransomwares)
- [BumbleBee and AdaptixC2 Deliver Akira Ransomware via Bing SEO (TechNadu)](https://www.technadu.com/bumblebee-and-adaptixc2-deliver-akira-ransomware-via-bing-seo/630178/)
- [Bing Search for ManageEngine OpManager Led to Akira Ransomware Attack (VPNCentral)](https://vpncentral.com/?p=252833)
- [From bing search to ransomware: bumblebee and adaptixc2 deliver akira (Gurucul)](https://gurucul.com/latest-threats/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira/)
- [Threat brief: From Bing Search to Ransomware (Vega)](https://threats.vega.io/brief/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4440