Bing results spread Bumblebee malware

Cybersecurity researchers have discovered an advanced SEO search engine poisoning campaign that exploited Bing search results to distribute the Bumblebee malware, ultimately leading to devastating Akira.

See also: Microsoft Edge: How to replace Bing with another search engine?

The campaign, which was active throughout July 2025, specifically targets users searching for legitimate IT management software, demonstrating how threat actors continue to weaponize trusted search platforms to compromise enterprise networks.

The attack began when unsuspecting users searched for “ManageEngine OpManager” on Microsoft’s Bing search engine and were redirected to the malicious opmanager[.]pro domain instead of the legitimate software vendor.

This carefully crafted website mimicked a trojanized MSI installer file named ManageEngine-OpManager.msi , which appeared identical to the genuine software package but contained embedded malicious components designed to establish initial access to victims' networks

When the malicious installer was run, the software appeared to operate normally, installing the legitimate ManageEngine OpManager application to avoid suspicion. However, during the installation process, the malware simultaneously deployed a malicious dynamic link library (DLL) named msimg32.dll via the Windows consent.exe process

DFIR Report analysts identified this advanced technique as a method to bypass security checks while maintaining the appearance of a legitimate software installation.

See also: Microsoft Bing displays misleading page that looks like Google

Approximately five hours after the initial execution, the malware deployed an AdaptixC2 identified as AdgNsy.exe, which created an additional communication channel to 172.96.137[.]160:443, providing threat actors with permanent access to the compromised environment.

The attack's success came largely from targeting IT management tools, ensuring that the users running the malware had highly privileged administrator accounts within Active Directory environments. This strategic approach gave threat actors direct access, eliminating the need for complex privilege escalation techniques typically required in targeted attacks.

After initial identification using built-in Windows tools, including systeminfo, nltest /dclist:, whoami /groups, and net group domain admins /dom , the attackers created two new domain accounts named backup_DA and backup_EA . The backup_EA account was strategically added to the Enterprise Administrators group, giving the attackers domain-wide administrative privileges

The threat actors then connected to the domain controllers via Remote Desktop Protocol (RDP) and extracted the NTDS.dit file using the Windows Backup Admin tool. This technique allowed them to obtain the password hashes for all domain accounts.

See also: Microsoft removes revenge porn from Bing search

The campaign culminated in the deployment of the Akira ransomware using the locker.exe payload, with the attackers achieving encryption in just 44 hours from initial access. The malicious actors demonstrated persistence by returning two days later to compromise subdomains, highlighting the campaign’s systematic and methodical approach to destroying enterprise-level networks.