A coordinated threat campaign has been identified leveraging SEO poisoning to distribute Bumblebee malware via trojanized installers of IT management tools. The campaign targets users searching for legitimate software like ManageEngine OpManager. Upon execution, Bumblebee establishes initial access, enabling lateral movement, credential dumping, deployment of remote access tools, and data exfiltration. The intrusions often end with the deployment of Akira ransomware, resulting in severe operational disruptions. Multiple organizations have been impacted, with various security teams reporting consistent patterns of compromise. Author: AlienVault
Related Tags:
trojanized installers
akira ransomware
Bumblebee – S1039
initial access
Bumblebee
lateral movement
data exfiltration
Akira
SEO poisoning
Associated Indicators:
186B26DF63DF3B7334043B47659CBA4185C948629D857D47452CC1936F0AA5DA
DE730D969854C3697FD0E0803826B4222F3A14EFE47E4C60ED749FFF6EDCE19D
A14506C6FB92A5AF88A6A44D273EDAFE10D69EE3D85C8B2A7AC458A22EDF68D2
A6DF0B49A5EF9FFD6513BFE061FB60F6D2941A440038E2DE8A7AEB1914945331
6BA5D96E52734CBB9246BCC3DECF127F780D48FA11587A1A44880C1F04404D23
F352CEC89A56E23DAE20CDD62DF4D40BC7F22B5E
1B9AA401457D29405C0BCF19CBF19A7028A0D214
BCEE0AB10B23F5999BCDB56C0B4A631A
A746DA514C90F26A187A294FDA7EDC1B