From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira

Executive summary

Sourced behaviors include user execution of a malicious MSI, msiexec execution, DLL side-loading, process injection, PowerShell, network discovery, RDP/SMB/WinRM lateral movement, NTDS credential access, and ransomware impact. The observable set contains 11 IPv4 addresses, 2 URLs, 3 MD5 hashes, 3 SHA-256 hashes, and 79 parser-domain results. Parser-domain output is retained for traceability; executable names, filenames, code tokens, redacted values, and other non-domain strings are explicitly false positives and are not blocklist recommendations.

Technical analysis

Sourced behaviors include user execution of a malicious MSI, msiexec execution, DLL side-loading, process injection, PowerShell, network discovery, RDP/SMB/WinRM lateral movement, NTDS credential access, and ransomware impact. The observable set contains 11 IPv4 addresses, 2 URLs, 3 MD5 hashes, 3 SHA-256 hashes, and 79 parser-domain results. Parser-domain output is retained for traceability; executable names, filenames, code tokens, redacted values, and other non-domain strings are explicitly false positives and are not blocklist recommendations.

Evidence and sources

The DFIR Report published From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira on 2026-06-29, describing Bing SEO poisoning, a trojanized MSI, Bumblebee, AdaptixC2 activity, lateral movement, credential access, and Akira ransomware; the report lists the associated network, URL, hash, and parser-domain observations.

IOCs

CVEs and affected products

No CVE or affected product is available.

ATT&CK mapping

Historical relationships

No published historical relationship is available.

Timeline and change history

Confidence and caveats

0.95

⚠️ Public threat intelligence only; no organizational exposure claim.

⚠️ VirusTotal/OTX enrichment is time-sensitive context, not proof of current maliciousness.

⚠️ AbuseIPDB returned HTTP 401 and supplied no score.

⚠️ Parser-domain results are not validated domains and include false positives.

⚠️ No YARA rule is generated because the supplied evidence contains hashes and observable behavior but no file or memory byte/string evidence.