TTPwire Vol. 1 · MITRE ATT&CK·Tagged

← All stories

The DFIR Report

From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira

editor · 2025-11-04 · Read original ↗

ATT&CK techniques detected

20 predictions
T1486Data Encrypted for Impact
99%
“##2941a440038e2de8a7aeb1914945331 ( bumblebee ) swisscom b2b csirt : msimg32. dll 6ba5d96e52734cbb9246bcc3decf127f780d48fa11587a1a44880c1f04404d23 ( bumblebee ) dfir report : locker. exe de730d969854c3697fd0e0803826b4222f3a14efe47e4c60ed749fff6edce19d ( akira ransomware ) swissco…”
T1003.003NTDS
99%
“0. 0. 1 \ c $ \ programdata \ - include " : c : \ windows \ ntds \ ntds. dit, c : \ windows \ system32 \ config \ system, c : \ windows \ system32 \ config \ security " - quiet for persistence and re - entry, the threat actor installed the rustdesk remote access tool on several h…”
T1486Data Encrypted for Impact
99%
“same time, the threat actor installed filezilla on a file server and exfiltrated data via sftp to 185. 174. 100 [. ] 203. they performed lsass memory dumping on multiple workstations using rundll32. exe with comsvcs. dll using a combination of remote services and wmi. the threat …”
T1218.007Msiexec
98%
“##ger site, we identified two additional websites that appear to be distributing trojanized installers for axis camera tools and angry ip scanner. refer to the ioc section for further details. detection engineering and threat hunting ( death ) - hunt for msi installations from us…”
T1003.001LSASS Memory
96%
“tasklist enumeration : cmd. exe / q / c for / f " tokens = 1, 2 delims = " % % a in ( ' " tasklist / fi " imagename eq lsass. exe " | find " lsass " " ' ) do rundll32. exe c : \ windows \ system32 \ comsvcs. dll, # + 000024 % % b \ windows \ temp \ *. * full - detect lsass dumps …”
T1486Data Encrypted for Impact
92%
“dumped credentials, installed persistent remote access tools, and exfiltrated data using an sftp client. the intrusion culminated in the deployment of akira ransomware across the root domain. the threat actor returned two days later to repeat the process, encrypting systems withi…”
T1003.003NTDS
89%
“credentials " - monitor wbadmin abuse for ntds. dit / hive dumping : wbadmin start backup - backuptarget : \ \ 127. 0. 0. 1 \ c $ \ programdata \ - include : " c : \ windows \ ntds \ ntds. dit, c : \ windows \ system32 \ config \ system, c : \ windows \ system32 \ config \ securi…”
T1003OS Credential Dumping
88%
“dumped credentials, installed persistent remote access tools, and exfiltrated data using an sftp client. the intrusion culminated in the deployment of akira ransomware across the root domain. the threat actor returned two days later to repeat the process, encrypting systems withi…”
T1608.006SEO Poisoning
86%
“from bing search to ransomware : bumblebee and adaptixc2 deliver akira from bing search to ransomware : bumblebee and adaptixc2 deliver akira overview bumblebee malware has been an initial access tool used by threat actors since late 2021. in 2023 the malware was first reported a…”
T1195.002Compromise Software Supply Chain
81%
“- private sigma ruleset : features 170 + sigma rules derived from 50 + cases, mapped to att & ck with test examples. - dfir labs : offers cloud - based, hands - on learning experiences, using real data, from real intrusions. interactive labs are available with different difficult…”
T1003.003NTDS
77%
“and software in both our intrusion and the one observed by swisscom b2b csirt, the users executing the malware were highly privileged it administrator accounts within active directory. this provided easy privileged access to the threat actors for their next actions. approximately…”
T1080Taint Shared Content
70%
“same time, the threat actor installed filezilla on a file server and exfiltrated data via sftp to 185. 174. 100 [. ] 203. they performed lsass memory dumping on multiple workstations using rundll32. exe with comsvcs. dll using a combination of remote services and wmi. the threat …”
T1572Protocol Tunneling
67%
“followed by ssh tunneling activity from the same network segment indicators of compromise ( iocs ) domains : ev2sirbd269o5j. org ( bumblebee dga domain ) 2rxyt9urhq0bgj. org ( bumblebee dga domain ) dfir report : opmanager [. ] pro ( malicious site for trojanized installer ) angr…”
T1482Domain Trust Discovery
67%
“credentials " - monitor wbadmin abuse for ntds. dit / hive dumping : wbadmin start backup - backuptarget : \ \ 127. 0. 0. 1 \ c $ \ programdata \ - include : " c : \ windows \ ntds \ ntds. dit, c : \ windows \ system32 \ config \ system, c : \ windows \ system32 \ config \ securi…”
T1176.001Browser Extensions
66%
“from bing search to ransomware : bumblebee and adaptixc2 deliver akira from bing search to ransomware : bumblebee and adaptixc2 deliver akira overview bumblebee malware has been an initial access tool used by threat actors since late 2021. in 2023 the malware was first reported a…”
T1136.002Domain Account
59%
“and software in both our intrusion and the one observed by swisscom b2b csirt, the users executing the malware were highly privileged it administrator accounts within active directory. this provided easy privileged access to the threat actors for their next actions. approximately…”
T1583.001Domains
43%
“followed by ssh tunneling activity from the same network segment indicators of compromise ( iocs ) domains : ev2sirbd269o5j. org ( bumblebee dga domain ) 2rxyt9urhq0bgj. org ( bumblebee dga domain ) dfir report : opmanager [. ] pro ( malicious site for trojanized installer ) angr…”
T1080Taint Shared Content
41%
“##2941a440038e2de8a7aeb1914945331 ( bumblebee ) swisscom b2b csirt : msimg32. dll 6ba5d96e52734cbb9246bcc3decf127f780d48fa11587a1a44880c1f04404d23 ( bumblebee ) dfir report : locker. exe de730d969854c3697fd0e0803826b4222f3a14efe47e4c60ed749fff6edce19d ( akira ransomware ) swissco…”
T1555.003Credentials from Web Browsers
38%
“from bing search to ransomware : bumblebee and adaptixc2 deliver akira from bing search to ransomware : bumblebee and adaptixc2 deliver akira overview bumblebee malware has been an initial access tool used by threat actors since late 2021. in 2023 the malware was first reported a…”
T1218.011Rundll32
32%
“. 242. 184 [. ] 150 ( ssh tunnel host ) swisscom b2b csirt : 83. 229. 17 [. ] 60 ( ssh tunnel host ) 185. 174. 100 [. ] 203 ( sftp exfiltration server ) file hashes : dfir report : manageengine - opmanager. msi 186b26df63df3b7334043b47659cba4185c948629d857d47452cc1936f0aa5da ( ma…”

Summary

Overview Bumblebee malware has been an initial access tool used by threat actors since late 2021. In 2023 the malware was first reported as using SEO poisoning as a delivery mechanism. Recently in May of 2025 Cyjax reported on a campaign using this method again, impersonating various IT tools. We observed a similar campaign in […]

The post From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira appeared first on The DFIR Report.