From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira

In July 2025, a threat actor used SEO poisoning (maliciously optimized Bing search results) to lure users searching for legitimate enterprise tools (e.g. ManageEngine OpManager) to download a trojanized installer that delivered Bumblebee malware. From there they moved aggressively through the network: establishing persistent remote access, obtaining high-privileged credentials (including via dumping domain controller NTDS.dit), performing lateral movement, exfiltrating data via SFTP, and ultimately deploying Akira ransomware first across the root domain and later into a child domain. The time from initial access to ransomware was rapid (≈44 hours in one case, ≈9 hours in another), and multiple organizations were affected. The campaign demonstrates a well-orchestrated end-to-end intrusion lifecycle, with emphasis on targeting privileged administrator accounts via plausible, trusted software installers.

This campaign is notable for pairing Bumblebee with AdaptixC2 in the same intrusion chain, a combination not widely reported before. It also highlights a sharpened delivery tactic, SEO poisoning of enterprise IT tools, which directly targets privileged users. Combined with the rapid domain-wide ransomware deployment, these shifts point to a streamlined and increasingly aggressive playbook.