From Bing Search to Ransomware Bumblebee and AdaptixC2 Deliver Akira
From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira
In July 2025, BumbleBee malware was deployed via SEO poisoning through a trojanized installer for ManageEngine OpManager. Following initial access, BumbleBee dropped an AdaptixC2 beacon to facilitate further intrusion activities, allowing the threat actor to pivot to a domain controller and dump the NTDS.dit. The threat actor returned the following day and established an SSH proxy, enabling lateral movement across the network and data exfiltration via FileZilla and SFTP to an external server. The threat actor concluded the intrusion by deploying Akira ransomware across the root domain and returned two days later to encrypt a child domain. This case was first reported to customers in a threat brief released in July 2025 and in a public flash alert in August 2025 in partnership with Swisscom B2B CSIRT, which observed another intrusion tied to the same campaign.
The BumbleBee intrusion was initiated in July 2025 via an SEO poisoning attack. A user searching Bing for “ManageEngine OpManager” was lured to a sophisticated lookalike domain. This site served a cloned interface that redirected the victim to download a trojanized MSI installer instead of the legitimate software. Upon downloading a trojanized MSI installer, the BumbleBee first-stage loader (msimg32.dll) was executed on a beachhead host via DLL side-loading. The victim subsequently moved the malicious MSI to an internal network share; from there, an IT administrator executed the file on the beachhead host. Technical analysis of the ManageEngine-OpManager.msi payload revealed a revoked code-signing certificate issued to “LLC Resource+.” Tracking provided by certgraveyard.org shows that this signer has a history of signing BumbleBee-related malware.
Approximately five hours after the initial infection, the threat actor deployed AdgNsy.exe, a renamed instance of the legitimate Windows Address Book utility, which was injected with AdaptixC2 shellcode. This established a persistent C2 channel, enabling the threat actor to perform living-off-the-land discovery commands such as systeminfo and nltest. To ensure persistence, the threat actor created new domain accounts with Enterprise Admin privileges and installed RustDesk as a Windows service on multiple servers. On the second and third days, the threat actor moved laterally using RDP to pivot to a domain controller and a backup server. They engaged in extensive credential harvesting, utilizing wbadmin.exe to extract the NTDS.dit Active Directory database and executing custom PowerShell scripts to dump and decrypt Veeam credentials via DPAPI. The threat actor also employed the lsassy utility to dump LSASS memory across multiple hosts. Throughout the intrusion, the threat actor leveraged defense evasion and tunneling techniques. This included using a reverse SSH tunnel to proxy RDP traffic and bypass firewall restrictions, as well as employing mixed-case command-line obfuscation (e.g., pOWerShELl.exE). Data exfiltration was primarily facilitated through FileZilla. Over 75GB of data, including file shares, sensitive user credentials, and SYSVOL domain configurations were exfiltrated to a threat actor-controlled server in Ukraine. The intrusion culminated approximately 44 hours after initial access with the deployment of Akira ransomware (staged as locker.exe), which used WMI to delete Volume Shadow Copies and maximize impact across the infrastructure.