Detections

From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira

DFIR Bumblebee AdaptixC2 Akira IOC Hunt

sigma · pending service validation

title: DFIR Report Bumblebee AdaptixC2 Akira IOC Hunt
id: 4c6e34d0-2e9b-5c89-8a3c-1c4f9ecb4e2d
status: experimental
description: Hunt for network or file telemetry reported in the June 29 2026 DFIR Report.
author: CTI-Hermes
date: 2026/08/27
references:
  - https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/
tags:
  - attack.t1189
  - attack.t1574.002
  - attack.t1055
logsource:
  category: proxy
  product: generic
detection:
  selection:
    DestinationIp: 4.239.95.1
  condition: selection
falsepositives:
  - Legitimate traffic; validate against source context.
level: high

DFIR Bumblebee AdaptixC2 Akira SPL Hunt

spl · pending service validation

index=* (dest_ip IN ('109.205.195.211','170.130.55.223','171.22.183.43','172.96.137.160','185.174.100.203','188.40.187.145','192.121.22.94','193.242.184.150','194.127.178.21','4.239.95.1','84.32.84.32') OR src_ip IN ('109.205.195.211','170.130.55.223','171.22.183.43','172.96.137.160','185.174.100.203','188.40.187.145','192.121.22.94','193.242.184.150','194.127.178.21','4.239.95.1','84.32.84.32') OR file_hash IN ('124a48b78060fa851e1cc077ca35713c','8c113b3aa82c81eee7c6b4ed0ba9a90f','ca8646dfc88423bb9fffda811160cebe','186b26df63df3b7334043b47659cba4185c948629d857d47452cc1936f0aa5da','a6df0b49a5ef9ffd6513bfe061fb60f6d2941a440038e2de8a7aeb1914945331','de730d969854c3697fd0e0803826b4222f3a14efe47e4c60ed749fff6edce19d') OR md5 IN ('124a48b78060fa851e1cc077ca35713c','8c113b3aa82c81eee7c6b4ed0ba9a90f','ca8646dfc88423bb9fffda811160cebe') OR sha256 IN ('186b26df63df3b7334043b47659cba4185c948629d857d47452cc1936f0aa5da','a6df0b49a5ef9ffd6513bfe061fb60f6d2941a440038e2de8a7aeb1914945331','de730d969854c3697fd0e0803826b4222f3a14efe47e4c60ed749fff6edce19d')) | stats count values(process_name) values(parent_process_name) values(dest_port) by host user dest_ip src_ip file_hash md5 sha256

DFIR Bumblebee AdaptixC2 Akira KQL Hunt

kql · pending service validation

DeviceNetworkEvents | where RemoteIP in~ ("109.205.195.211","170.130.55.223","171.22.183.43","172.96.137.160","185.174.100.203","188.40.187.145","192.121.22.94","193.242.184.150","194.127.178.21","4.239.95.1","84.32.84.32") or RemoteUrl has_any ("tria.ge/250530-ttmjhayzhw","tria.ge/250812-zw4tfszpy4") | project Timestamp,DeviceName,InitiatingProcessFileName,RemoteIP,RemoteUrl