Bumblebee SEO poisoning campaign delivers Akira ransomware
Threat actors used SEO-poisoned search results for IT tools to deploy Bumblebee malware, escalating to domain compromise and Akira ransomware deployment within 44 hours.
Sourcethedfirreport.com — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
In July 2025, threat actors compromised organizations through SEO poisoning campaigns targeting users searching for legitimate IT management tools. Victims searching for "ManageEngine OpManager" on Bing were directed to malicious sites hosting trojanized MSI installers. Upon execution, these installers deployed Bumblebee malware, which established command and control communications. The targeting of IT tools meant compromised users were often privileged IT administrators, providing immediate high-level access.
The threat actors rapidly escalated privileges within five hours, deploying AdaptixC2 beacons and conducting extensive reconnaissance. They created new domain administrator accounts, moved laterally to domain controllers, and dumped credentials using wbadmin and LSASS memory dumping techniques. The attackers installed RustDesk for persistence, established SSH tunnels for proxy operations, and used FileZilla to exfiltrate data via SFTP.
The intrusion culminated in Akira ransomware deployment approximately 44 hours after initial access, with the threat actors returning two days later to encrypt a child domain. Swisscom B2B CSIRT confirmed similar intrusions during the same period, with one case showing an even faster time-to-ransomware of nine hours. Additional malicious sites distributing trojanized versions of Axis Camera tools and Angry IP Scanner were also identified.
Mentioned in this report
Detection guidance
NTDS.dit Credential Dumping via wbadmin System State Backup
A behavioural hunt for the technique in general.
Detects use of wbadmin.exe to create a system state backup, a common technique to indirectly extract NTDS.dit and SAM/SYSTEM registry hives from a domain controller for offline credential extraction. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: NTDS.dit Credential Dumping via wbadmin System State Backup
id: 0b004c9b-5297-592f-b2d8-26c4c009c538
status: experimental
description: Detects wbadmin.exe invoked to perform a system state backup, which threat
actors abuse to obtain NTDS.dit, SYSTEM and SAM hives from domain controllers for
offline credential dumping (observed in Bumblebee-to-Akira intrusions).
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: \\wbadmin.exe
CommandLine|contains|all:
- backup
- systemstatebackup
filter:
ParentImage|endswith:
- \\BackupExec.exe
- \\veeam.exe
condition: selection and not filter
falsepositives:
- Scheduled legitimate system state backups performed by backup administration software
- IT staff manually backing up domain controller system state for disaster recovery
level: high
tags:
- attack.credential-access
- attack.t1003.003
author: Vorant
LSASS Memory Dump via rundll32 comsvcs.dll MiniDump
A behavioural hunt for the technique in general.
Detects the well-known LOLBin technique of invoking rundll32.exe with comsvcs.dll MiniDump export to dump LSASS process memory for credential extraction, observed during the post-compromise phase of this intrusion. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: LSASS Memory Dump via rundll32 comsvcs.dll MiniDump
id: 3683af00-1881-5c6c-8eba-3365aa1a4403
status: experimental
description: Detects rundll32.exe calling the MiniDump export of comsvcs.dll, a common
technique used to dump LSASS process memory and later extract credentials offline,
as observed in Bumblebee/Akira intrusions.
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: \\rundll32.exe
CommandLine|contains:
- comsvcs.dll
CommandLine|contains|all:
- comsvcs.dll
- MiniDump
condition: selection
falsepositives:
- Legitimate diagnostic memory dump collection by IT support staff using documented
Microsoft procedure (rare in normal operations)
level: high
tags:
- attack.credential-access
- attack.t1003.001
author: Vorant
RustDesk Silent Install Used as Remote Access Persistence Tool
A behavioural hunt for the technique in general.
Detects silent/unattended installation of the RustDesk remote desktop client, which was deployed by threat actors post-compromise to maintain persistent remote access alongside legitimate administrative use. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: RustDesk Silent Install Used as Remote Access Persistence Tool
id: 583fec1d-4870-5eb8-9213-f51a587d5180
status: experimental
description: Detects RustDesk being installed with silent/unattended installer flags,
a pattern observed when threat actors deploy RustDesk covertly to establish persistent
remote access after initial compromise.
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: \\rustdesk.exe
CommandLine|contains:
- --silent-install
- --install
filter:
ParentImage|endswith:
- \\ccmexec.exe
- \\SCCM\\CcmExec.exe
condition: selection and not filter
falsepositives:
- IT administrators deliberately deploying RustDesk via approved software packaging/deployment
tools
- Managed software distribution silently installing RustDesk as an authorized remote
support tool
level: medium
tags:
- attack.persistence
- attack.command-and-control
- attack.t1219
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://thedfirreport.com/2025/08/05/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-2
Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the malware it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs