From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira
Essential information
- Published
- 29/06/2026 17:46
- Modified
- 07/08/2025 15:35
- Source / Author
- AlienVault
- Confidence
- 100/100
- Report type(s)
- threat-report
- Labels / Tags
- adaptixc2 akira bumblebee credential dumping lateral movement rustdesk seo poisoning trojanized installer
- Tags
- 2025-08-07 adaptixc2 akira bumblebee credential-theft data exfiltration it management tools lateral movement ransomware rustdesk seo poisoning
- Related entities
- 16 indicators, 10 observables, 20 techniques (mitre), 3 malware
Description
In July 2025, threat actors compromised organizations through SEO poisoning campaigns targeting users searching for legitimate IT management tools. Users downloading trojanized installers for ManageEngine OpManager received Bumblebee malware, granting initial access. The attackers exploited the fact that users executing these IT tools were privileged administrators, enabling rapid lateral movement to domain controllers. They dumped credentials using wbadmin, created backdoor accounts with enterprise admin privileges, and installed RustDesk for persistent access. AdaptixC2 beacons were deployed for command and control. The threat actors conducted extensive reconnaissance, dumped LSASS memory across multiple systems, attempted Veeam credential theft, and exfiltrated data via SFTP using FileZilla. The intrusion culminated in Akira ransomware deployment across both root and child domains within 44 hours, with subsequent re-encryption two days later affecting the child domain.