Cyber attackers are abusing the popularity of ManageEngine OpManager, a widely used network monitoring solution, to distribute a trojanized ManageEngine OpManager installer that delivers BumbleBee malware and enables Akira ransomware attacks.
Attackers used SEO poisoning to push a fake website near the top of Bing search results, tricking users into downloading a compromised installer instead of the legitimate software.
Once executed, the installer delivered BumbleBee malware, which enabled attackers to establish initial access, deploy an AdaptixC2 beacon, perform credential theft, exfiltrate sensitive data, and ultimately deploy Akira ransomware.
The attackers progressed from initial infection to full ransomware deployment in less than two days, demonstrating both speed and operational maturity.
Severity: Critical
Threat Type: SEO Poisoning → BumbleBee Malware → AdaptixC2 → Akira Ransomware
Affected Users: IT Administrators, System Administrators, Network Operations Teams, Enterprise Environments
Organizations frequently rely on search engines to locate software downloads, vendor documentation, and administrative tools. Threat actors are increasingly exploiting this trust by manipulating search engine rankings and impersonating legitimate software vendors.
In this campaign, attackers specifically targeted users searching for ManageEngine OpManager.
By targeting over-permissioned users, the threat actors increased their chances of gaining more high-end access shortly after compromising, reducing the need for complex privilege escalation techniques.
After gaining initial access through BumbleBee malware, the attackers conducted extensive reconnaissance to identify domain controllers, privileged accounts, and other critical assets within the enterprise environment.
They used native Windows commands and administrative tools to blend into normal activity and avoid detection. To maintain and expand access, the threat actors:
The attackers then focused on credential theft, Active Directory compromise, and sensitive data collection to prepare for ransomware deployment.
They extracted
Before deploying ransomware, the threat of actors exfiltrated more than 75 GB of data using FileZilla and Secure File Transfer Protocol (SFTP).
This behavior aligns with modern double-extortion ransomware operations. In double-extortion ransomware operations, sensitive data is stolen before encryption and later used as leverage during ransom negotiations.
The ability to steal both credentials and sensitive business information significantly increases the potential impact of the attack, even if organizations can recover encrypted systems from backups.
The final stage of the attack involved the deployment of Akira ransomware.
The ransomware was observed executing as locker.exe and deleting Volume Shadow Copies through Windows Management Instrumentation (WMI), limiting recovery options for affected organizations.
Systems across the primary domain were encrypted, and the attackers later returned to compromise a child domain, extending the impact of the attack.
This shows a methodical approach, where the cyber actors first gained access, used privileges, stole data, and then moved to ransomware deployment.
Organizations should take the following actions to mitigate the risk of similar attacks:
This campaign demonstrates how search engine manipulation can serve as an effective initial access vector for ransomware operators.
By tricking users about a trusted IT management solution, attackers successfully delivered BumbleBee malware, established persistence using AdaptixC2, stole sensitive data, and ultimately deployed Akira ransomware.
Organizations and users should remain vigilant when downloading software, validate download sources carefully, and monitor post-compromise behaviors commonly associated with BumbleBee and Akira ransomware operations.