Flash Alert: From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira
ID: d0690fde-e1da-52a9-aeae-a3d66f338b50
STIX ID: report--d0690fde-e1da-52a9-aeae-a3d66f338b50
Feed Name: The DFIR Report
Threat Score
Executive summary: In July 2025 a campaign using SEO-poisoned downloads of trojanized IT management tools delivered the Bumblebee loader (msimg32.dll) that provided initial access, leading to AdaptixC2 beacons, NTDS.dit dumping via wbadmin, credential theft (LSASS dumps), installation of remote access tools (RustDesk), SSH tunneling for proxying, data exfiltration via SFTP, and domain-wide deployment of Akira ransomware across root and child domains; the report includes IOCs and detailed detection and hunting guidance.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.