From Bing Search to Ransomware: BumbleBee Delivers Akira
Source: The DFIR Report
44 hrs
Time to Ransomware
75+ GB
Data Exfiltrated
2 Domains
Encrypted
T1189
Initial Access
What Happened
In July 2025, threat actors used SEO poisoning to lure an IT administrator searching for 'ManageEngine OpManager' to a malicious lookalike site. The trojanized MSI installer deployed BumbleBee malware via DLL side-loading, which then delivered AdaptixC2 for persistent access. Within 44 hours, the attackers had compromised the entire domain and deployed Akira ransomware after exfiltrating over 75GB of data.
What Actually Happened Here?
An IT admin searched Bing for network monitoring software. The first result looked legitimate but was actually a fake site run by criminals. When they downloaded and installed the software, it secretly installed malware alongside the real program. The attackers then spent two days quietly exploring the network, stealing passwords, and copying sensitive files to their own servers. Finally, they encrypted everything and demanded payment.
The Attack Chain
-
Initial Access: User searches Bing for 'ManageEngine OpManager', clicks SEO-poisoned result leading to opmanager[.]pro, redirected to download-center[.]online serving trojanized MSI
Technique: Drive-by Compromise (T1189) | Tools: SEO Poisoning, Lookalike Domain | T+0 -
Execution: Malicious MSI drops consent.exe (legit Windows binary) alongside msimg32.dll (BumbleBee loader). Windows DLL search order loads malicious DLL into trusted process
Technique: DLL Side-Loading (T1574.001) | Tools: BumbleBee Loader, consent.exe | T+0 -
Command & Control: BumbleBee loader queries DGA domains (14-char.org pattern), establishes C2. AdaptixC2 beacon deployed via process injection into WAB.exe
Technique: Domain Generation Algorithm (T1568.002) | Tools: BumbleBee C2, AdaptixC2 | T+5 hrs -
Persistence: RustDesk installed as Windows service on multiple servers. New domain accounts created with Enterprise Admin privileges
Technique: Windows Service (T1543.003) | Tools: RustDesk, net user | T+6 hrs -
Credential Access: lsassy used to dump LSASS across hosts. wbadmin.exe extracts NTDS.dit from domain controller. PowerShell scripts decrypt Veeam credentials via DPAPI
Technique: LSASS Memory (T1003.001) + NTDS (T1003.003) | Tools: lsassy, wbadmin, DPAPI | T+24 hrs -
Lateral Movement: SSH tunnel proxies RDP traffic to bypass firewall. Attackers pivot to domain controllers and backup servers
Technique: RDP (T1021.001) + SMB (T1021.002) | Tools: SSH Tunnel, RDP | T+30 hrs -
Exfiltration: FileZilla introduced via RDP clipboard. 75GB+ exfiltrated to attacker server in Ukraine including file shares, credentials, and SYSVOL configs
Technique: Exfiltration Over C2 (T1041) | Tools: FileZilla, SFTP | T+40 hrs -
Impact: Akira ransomware (locker.exe) deployed. WMI deletes Volume Shadow Copies. Root domain encrypted, child domain encrypted 2 days later
Technique: Data Encrypted for Impact (T1486) | Tools: Akira Ransomware, WMI | T+44 hrs
Where Sentry North Would Intervene
Initial Access - MSI Signer Anomaly
Static Analysis
The trojanized MSI was signed by 'LLC Resource+' - a revoked certificate with known BumbleBee associations. Sentry's signature validation flags revoked and suspicious signers.
BLOCKED
Execution - DLL Side-Loading Pattern
Behavioral Detection
consent.exe executing from %APPDATA% instead of System32 triggers anomaly detection. Loading msimg32.dll from non-standard path flagged immediately.
BLOCKED
Execution - BumbleBee Loader Characteristics
ML Classification
The msimg32.dll exhibits dictionary-derived gibberish in PE metadata (known BumbleBee builder pattern) plus CIS-region geofencing code - strong malware indicators.
MALICIOUS (Score: 96/100)
C2 Communication - DGA Domain Queries
Network Monitoring
Rapid DNS queries to 14-character .org domains matching BumbleBee DGA pattern triggers network anomaly alert.
ALERT
Credential Access - LSASS Access
Behavioral Detection
Any process attempting to read LSASS memory triggers immediate alert. wbadmin.exe accessing NTDS.dit flagged as credential theft attempt.
BLOCKED
Impact - Akira Ransomware Signature
Ransomware Protection
locker.exe matches known Akira ransomware signatures. Volume Shadow Copy deletion via WMI blocked by ransomware protection layer.
BLOCKED
What This Means For Your Business
- Train staff to verify download sources - even top search results can be malicious
- Monitor for software installations from non-standard paths
- Implement network segmentation to limit lateral movement
- Maintain offline backups that ransomware cannot reach
- Use endpoint detection that monitors for credential theft attempts
🔍 Technical Deep Dive
For security professionals and those who want more detail:
Who's Behind This
BumbleBee Operators
Akira Ransomware affiliate
Initial access broker known for SEO poisoning campaigns targeting enterprise software. Linked to Conti successor groups.
MITRE ATT&CK Techniques
Techniques observed in this intrusion, mapped to industry-standard framework:
T1189
Drive-by Compromise
Initial Access
T1574.001
DLL Side-Loading
Persistence
T1055
Process Injection
Defense Evasion
T1568.002
Domain Generation Algorithms
Command and Control
T1003.001
LSASS Memory
Credential Access
T1003.003
NTDS
Credential Access
T1021.001
Remote Desktop Protocol
Lateral Movement
T1041
Exfiltration Over C2 Channel
Exfiltration
T1486
Data Encrypted for Impact
Impact
T1490
Inhibit System Recovery
Impact
Indicators of Compromise
File Hashes
ManageEngine-OpManager.msi186b26df63df3b7334043b47659cba4185c948629d857d47452cc1936f0aa5da
msimg32.dll (BumbleBee)a6df0b49a5ef9ffd6513bfe061fb60f6d2941a440038e2de8a7aeb1914945331
locker.exe (Akira)de730d969854c3697fd0e0803826b4222f3a14efe47e4c60ed749fff6edce19d
Domains
opmanager[.]prodownload-center[.]onlineev2sirbd269o5j[.]org2rxyt8yrhq0bgj[.]orgIP Addresses
172.96.137.160 (AdaptixC2)193.242.184.150 (SSH Tunnel)185.174.100.203 (Exfil Server)