From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira
In July 2025, threat actors compromised organizations through SEO poisoning campaigns targeting users searching for legitimate IT management tools. Users downloading trojanized installers for ManageEngine OpManager received Bumblebee malware, granting initial access. The attackers exploited the fact that users executing these IT tools were privileged administrators, enabling rapid lateral movement to domain controllers. They dumped credentials using wbadmin, created backdoor accounts with enterprise admin privileges, and installed RustDesk for persistent access. AdaptixC2 beacons were deployed for command and control. The threat actors conducted extensive reconnaissance, dumped LSASS memory across multiple systems, attempted Veeam credential theft, and exfiltrated data via SFTP using FileZilla. The intrusion culminated in Akira ransomware deployment across both root and child domains within 44 hours, with subsequent re-encryption two days later affecting the child domain.
Pulse ID: 6a429369377f216bcfbdda03
Pulse Link: https://otx.alienvault.com/pulse/6a429369377f216bcfbdda03
Pulse Author: AlienVault
Created: 2026-06-29 15:46:49
Be advised, this data is unverified and should be considered preliminary. Always do further verification.
#Akira #BackDoor #Bumblebee #CyberSecurity #DomainController #Encryption #FileZilla #InfoSec #Malware #OTX #OpenThreatExchange #RAT #RansomWare #Rust #SEOPoisoning #Trojan #Troll #bot #AlienVault





