← Back to Feed
Flash Alert: From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira
August 5, 2025 · DFIR Report · Severity: CRITICAL
Overview Bumblebee malware has been an initial access tool used by threat actors since late 2021. In 2023 the malware was first reported as using SEO poisoning as a delivery mechanism. Recently in May of 2025 Cyjax reported on a campaign using this method again, impersonating various IT tools. We observed a similar campaign in […] The post Flash Alert: From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira appeared first on The DFIR Report.
Key Takeaways
- DFIR Report detailed a flash alert case where Bumblebee malware and AdaptixC2 delivered Akira ransomware after a Bing search led to infection.
- Bumblebee, an initial access tool since late 2021, used SEO poisoning that impersonated various IT tools in the campaign.
- Users should avoid downloading IT tools from search ads, as SEO poisoning delivers Bumblebee and leads to Akira ransomware.