Bumblebee SEO poisoning campaign delivers Akira ransomware
Threat actors used SEO-poisoned search results for IT tools to deploy Bumblebee malware, escalating to domain compromise and Akira ransomware deployment within 44 hours.
In July 2025, threat actors compromised organizations through SEO poisoning campaigns targeting users searching for legitimate IT management tools. Victims searching for "ManageEngine OpManager" on Bing were directed to malicious sites hosting trojanized MSI installers. Upon execution, these installers deployed Bumblebee malware, which established command and control communications. The targeting of IT tools meant compromised users were often privileged IT administrators, providing immediate high-level access.
The threat actors rapidly escalated privileges within five hours, deploying AdaptixC2 beacons and conducting extensive reconnaissance. They created new domain administrator accounts, moved laterally to domain controllers, and dumped credentials using wbadmin and LSASS memory dumping techniques. The attackers installed RustDesk for persistence, established SSH tunnels for proxy operations, and used FileZilla to exfiltrate data via SFTP.
The intrusion culminated in Akira ransomware deployment approximately 44 hours after initial access, with the threat actors returning two days later to encrypt a child domain. Swisscom B2B CSIRT confirmed similar intrusions during the same period, with one case showing an even faster time-to-ransomware of nine hours. Additional malicious sites distributing trojanized versions of Axis Camera tools and Angry IP Scanner were also identified.
Mentioned in this report
Detection guidance
NTDS.dit Credential Dumping via wbadmin System State Backup
Detects use of wbadmin.exe to create a system state backup, a common technique to indirectly extract NTDS.dit and SAM/SYSTEM registry hives from a domain controller for offline credential extraction. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: NTDS.dit Credential Dumping via wbadmin System State Backup
id: 0b004c9b-5297-592f-b2d8-26c4c009c538
status: experimental
description: Detects wbadmin.exe invoked to perform a system state backup, which threat
actors abuse to obtain NTDS.dit, SYSTEM and SAM hives from domain controllers for
offline credential dumping (observed in Bumblebee-to-Akira intrusions).
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: \\wbadmin.exe
CommandLine|contains|all:
- backup
- systemstatebackup
filter:
ParentImage|endswith:
- \\BackupExec.exe
- \\veeam.exe
condition: selection and not filter
falsepositives:
- Scheduled legitimate system state backups performed by backup administration software
- IT staff manually backing up domain controller system state for disaster recovery
level: high
tags:
- attack.credential_access
- attack.t1003.003
author: Vorant
LSASS Memory Dump via rundll32 comsvcs.dll MiniDump
Detects the well-known LOLBin technique of invoking rundll32.exe with comsvcs.dll MiniDump export to dump LSASS process memory for credential extraction, observed during the post-compromise phase of this intrusion. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: LSASS Memory Dump via rundll32 comsvcs.dll MiniDump
id: 3683af00-1881-5c6c-8eba-3365aa1a4403
status: experimental
description: Detects rundll32.exe calling the MiniDump export of comsvcs.dll, a common
technique used to dump LSASS process memory and later extract credentials offline,
as observed in Bumblebee/Akira intrusions.
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: \\rundll32.exe
CommandLine|contains:
- comsvcs.dll
CommandLine|contains|all:
- comsvcs.dll
- MiniDump
condition: selection
falsepositives:
- Legitimate diagnostic memory dump collection by IT support staff using documented
Microsoft procedure (rare in normal operations)
level: high
tags:
- attack.credential_access
- attack.t1003.001
author: Vorant
RustDesk Silent Install Used as Remote Access Persistence Tool
Detects silent/unattended installation of the RustDesk remote desktop client, which was deployed by threat actors post-compromise to maintain persistent remote access alongside legitimate administrative use. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: RustDesk Silent Install Used as Remote Access Persistence Tool
id: 583fec1d-4870-5eb8-9213-f51a587d5180
status: experimental
description: Detects RustDesk being installed with silent/unattended installer flags,
a pattern observed when threat actors deploy RustDesk covertly to establish persistent
remote access after initial compromise.
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: \\rustdesk.exe
CommandLine|contains:
- --silent-install
- --install
filter:
ParentImage|endswith:
- \\ccmexec.exe
- \\SCCM\\CcmExec.exe
condition: selection and not filter
falsepositives:
- IT administrators deliberately deploying RustDesk via approved software packaging/deployment
tools
- Managed software distribution silently installing RustDesk as an authorized remote
support tool
level: medium
tags:
- attack.persistence
- attack.command_and_control
- attack.t1219
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://thedfirreport.com/2025/08/05/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-2
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free