Akira ransomware hits via BumbleBee SEO poisoning

29 June 2026 high threat technology

BumbleBee loader deployed via trojanized ManageEngine installer executed AdaptixC2, enabling credential theft, lateral movement, and Akira ransomware across multiple domains.

In July 2025, threat actors leveraged SEO poisoning on Bing to distribute BumbleBee malware masquerading as ManageEngine OpManager and other enterprise software. When an administrator downloaded and executed the trojanized MSI installer, it deployed the BumbleBee loader via DLL side-loading, establishing command-and-control within the victim network. Five hours post-infection, the actors deployed AdaptixC2 for persistent access, created privileged domain accounts, and installed RustDesk as a backdoor service.

Over the subsequent 44 hours, the threat actors conducted extensive credential harvesting, dumping NTDS.dit via wbadmin, extracting Veeam credentials through DPAPI decryption, and remotely dumping LSASS memory using the lsassy utility. They moved laterally via RDP, established an SSH reverse tunnel for proxy access, and exfiltrated over 75GB of data—including file shares, credentials, and SYSVOL configurations—to a Ukrainian server using FileZilla. Defense evasion techniques included process injection into legitimate Windows binaries, mixed-case command obfuscation, and in a parallel incident, a BYOVD attack to neutralize endpoint security.

The intrusion culminated with Akira ransomware deployment across the root domain, using WMI to delete Volume Shadow Copies. Two days later, the actors returned to encrypt a child domain. This campaign exhibited significant infrastructure overlap with previous BumbleBee waves, all hosted on Hostinger infrastructure and signed with certificates from Russian entities. A related October 2025 campaign targeting Ivanti VPN users shared tactical similarities but delivered a credential stealer instead of BumbleBee.

Mentioned in this report

Malware AdaptixC2AkiraBumblebeeRustDesklsassy

Detection guidance

NTDS.dit Extraction via Wbadmin Backup Command

ATT&CK T1003.003

Detects use of wbadmin to create a system state or ntds backup, a common technique for exfiltrating NTDS.dit from domain controllers Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: NTDS.dit Extraction via Wbadmin Backup Command
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \wbadmin.exe
    CommandLine|contains:
    - start backup
    - systemstatebackup
    - catalog
  ntds_ref:
    CommandLine|contains:
    - ntds
    - NTDS
  condition: selection and ntds_ref
falsepositives:
- Legitimate scheduled system state backups performed by backup administrators (typically
  run on a regular schedule from known backup servers, not by interactive/remote admin
  sessions)
level: high
tags:
- attack.t1003.003
- attack.credential_access
id: 78d7e50c-3693-588a-a658-8bfe5bee5458
status: experimental
author: Vorant

LSASS Memory Dump via Rundll32 comsvcs.dll MiniDump

ATT&CK T1003.001

Detects the use of rundll32.exe to invoke comsvcs.dll MiniDump export against lsass.exe, a technique used by tools such as lsassy for remote credential dumping Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: LSASS Memory Dump via Rundll32 comsvcs.dll MiniDump
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \rundll32.exe
    CommandLine|contains:
    - comsvcs.dll
  minidump:
    CommandLine|contains:
    - MiniDump
    - minidump
  lsass_target:
    CommandLine|contains:
    - lsass
  condition: selection and minidump and lsass_target
falsepositives:
- Legitimate crash dump troubleshooting performed by IT staff using comsvcs.dll (rare
  and should be validated against change tickets)
level: high
tags:
- attack.t1003.001
- attack.t1218.011
- attack.credential_access
- attack.defense_evasion
id: 048d78f1-f26a-5a7c-9f2d-e2f1e352155e
status: experimental
author: Vorant

Volume Shadow Copy Deletion via WMI Process

ATT&CK T1490

Detects deletion of Volume Shadow Copies via WMI (WmiPrvSe.exe spawning shadow copy deletion commands or WMI shadowcopy class calls), consistent with ransomware inhibiting system recovery prior to encryption Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Volume Shadow Copy Deletion via WMI Process
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: \WmiPrvSE.exe
  selection_cmd:
  - CommandLine|contains:
    - shadowcopy
    - Win32_ShadowCopy
  - Image|endswith:
    - \vssadmin.exe
  selection_action:
    CommandLine|contains:
    - delete
    - Delete
  condition: selection_parent and selection_cmd and selection_action
falsepositives:
- Legitimate backup software (e.g. Veeam, Backup Exec) that manages shadow copy lifecycle
  via WMI on scheduled maintenance windows
level: high
tags:
- attack.t1490
- attack.t1047
- attack.impact
id: 169ec43b-fe46-5637-9263-eedadc063be9
status: experimental
author: Vorant

3 more detection artefacts for this report (IOC-atomic rules, Splunk/KQL/Elastic conversions, YARA, Suricata) are available to subscribers.

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free