Akira ransomware hits via BumbleBee SEO poisoning
BumbleBee loader deployed via trojanized ManageEngine installer executed AdaptixC2, enabling credential theft, lateral movement, and Akira ransomware across multiple domains.
Sourcethedfirreport.com — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
In July 2025, threat actors leveraged SEO poisoning on Bing to distribute BumbleBee malware masquerading as ManageEngine OpManager and other enterprise software. When an administrator downloaded and executed the trojanized MSI installer, it deployed the BumbleBee loader via DLL side-loading, establishing command-and-control within the victim network. Five hours post-infection, the actors deployed AdaptixC2 for persistent access, created privileged domain accounts, and installed RustDesk as a backdoor service.
Over the subsequent 44 hours, the threat actors conducted extensive credential harvesting, dumping NTDS.dit via wbadmin, extracting Veeam credentials through DPAPI decryption, and remotely dumping LSASS memory using the lsassy utility. They moved laterally via RDP, established an SSH reverse tunnel for proxy access, and exfiltrated over 75GB of data—including file shares, credentials, and SYSVOL configurations—to a Ukrainian server using FileZilla. Defense evasion techniques included process injection into legitimate Windows binaries, mixed-case command obfuscation, and in a parallel incident, a BYOVD attack to neutralize endpoint security.
The intrusion culminated with Akira ransomware deployment across the root domain, using WMI to delete Volume Shadow Copies. Two days later, the actors returned to encrypt a child domain. This campaign exhibited significant infrastructure overlap with previous BumbleBee waves, all hosted on Hostinger infrastructure and signed with certificates from Russian entities. A related October 2025 campaign targeting Ivanti VPN users shared tactical similarities but delivered a credential stealer instead of BumbleBee.
Mentioned in this report
Detection guidance
NTDS.dit Extraction via Wbadmin Backup Command
A behavioural hunt for the technique in general.
Detects use of wbadmin to create a system state or ntds backup, a common technique for exfiltrating NTDS.dit from domain controllers Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: NTDS.dit Extraction via Wbadmin Backup Command
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: \wbadmin.exe
CommandLine|contains:
- start backup
- systemstatebackup
- catalog
ntds_ref:
CommandLine|contains:
- ntds
- NTDS
condition: selection and ntds_ref
falsepositives:
- Legitimate scheduled system state backups performed by backup administrators (typically
run on a regular schedule from known backup servers, not by interactive/remote admin
sessions)
level: high
tags:
- attack.t1003.003
- attack.credential-access
id: 78d7e50c-3693-588a-a658-8bfe5bee5458
status: experimental
author: Vorant
LSASS Memory Dump via Rundll32 comsvcs.dll MiniDump
A behavioural hunt for the technique in general.
Detects the use of rundll32.exe to invoke comsvcs.dll MiniDump export against lsass.exe, a technique used by tools such as lsassy for remote credential dumping Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: LSASS Memory Dump via Rundll32 comsvcs.dll MiniDump
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: \rundll32.exe
CommandLine|contains:
- comsvcs.dll
minidump:
CommandLine|contains:
- MiniDump
- minidump
lsass_target:
CommandLine|contains:
- lsass
condition: selection and minidump and lsass_target
falsepositives:
- Legitimate crash dump troubleshooting performed by IT staff using comsvcs.dll (rare
and should be validated against change tickets)
level: high
tags:
- attack.t1003.001
- attack.t1218.011
- attack.credential-access
- attack.stealth
id: 048d78f1-f26a-5a7c-9f2d-e2f1e352155e
status: experimental
author: Vorant
Volume Shadow Copy Deletion via WMI Process
A behavioural hunt for the technique in general.
Detects deletion of Volume Shadow Copies via WMI (WmiPrvSe.exe spawning shadow copy deletion commands or WMI shadowcopy class calls), consistent with ransomware inhibiting system recovery prior to encryption Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Volume Shadow Copy Deletion via WMI Process
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith: \WmiPrvSE.exe
selection_cmd:
- CommandLine|contains:
- shadowcopy
- Win32_ShadowCopy
- Image|endswith:
- \vssadmin.exe
selection_action:
CommandLine|contains:
- delete
- Delete
condition: selection_parent and selection_cmd and selection_action
falsepositives:
- Legitimate backup software (e.g. Veeam, Backup Exec) that manages shadow copy lifecycle
via WMI on scheduled maintenance windows
level: high
tags:
- attack.t1490
- attack.t1047
- attack.impact
id: 169ec43b-fe46-5637-9263-eedadc063be9
status: experimental
author: Vorant
3 more detections for this report are in the app — indicator rules, each with Sigma, Splunk SPL, and Elastic, some with Microsoft Defender XDR KQL, YARA, or Suricata as well. Free account, no card.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/
Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the malware it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs