From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira

A sophisticated cyber attack campaign leveraged SEO poisoning to compromise organizations through trojanized IT management tool installers. The attack began when users searching for ManageEngine OpManager were directed to a malicious website, downloading a compromised MSI file that installed Bumblebee malware. The threat actors then deployed AdaptixC2 beacons, performed internal reconnaissance, created privileged accounts, and installed RustDesk for persistence. They exfiltrated data via SFTP and ultimately deployed Akira ransomware across the network. The campaign affected multiple organizations, with time to ransomware ranging from 9 to 44 hours after initial access. The attackers used various tools and techniques for lateral movement, credential theft, and defense evasion.

• Stray Cat, Open Doors: How k0t Wanders Through the Network EdgeCampaign2026-10-21
• Open Season on Kapibala: Attacker Steals Over 18,000 Government Records Through WordPress ExploitationCampaign2026-09-22
• Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257ExploitedVulnerability2026-10-20
• In Other News: Tor Exit Relays Hijacked, Banks Spot Rogue AI Agents, Self-Rebuilding macOS RansomwareAnalysis2026-10-23
• SEO Poisoning Campaign Delivers New Armorsteal MalwareMalware2026-10-22