{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "promote-to-detection", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "Bumblebee is a precursor to Akira ransomware and large-scale data exfiltration (75GB+ observed). Identifying it during initial side-loading and persistence prevents catastrophic domain-wide encryption." }, "name": "Bumblebee Delivery and Persistence", "type": "investigation", "labels": [ "hunt", "attack.t1566.002", "attack.t1583.008", "attack.t1204.002", "attack.t1574.002", "attack.t1136.002", "attack.t1543.003", "attack.t1105" ], "series": { "slug": "from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira", "index": 1, "title": "From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira", "total": 2 }, "related": [ { "hunt": "discovery-credential-dumping", "reason": "Once persistence is established, Bumblebee operators typically move to dumping NTDS.dit and harvesting credentials.", "relation": "follows" } ], "targets": { "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] } }, "analysis": "A simple rule might catch consent.exe in a user path, but this hunt correlates that event with search-engine poisoning infrastructure and rare persistence tools like RustDesk, reducing false positives from legitimate software testing while providing full breach context.", "coverage": [ { "stage": "initial-access-seo-poisoning", "steps": [ "campaign-dns-activity" ], "status": "covered" }, { "stage": "execution-sideloaded-loader", "steps": [ "detect-sideloading-lead" ], "status": "covered" }, { "stage": "persistence-c2-establishment", "steps": [ "rare-persistence-prevalence" ], "status": "covered" }, { "stage": "discovery-credential-dumping", "reason": "Belongs to another part of the 'From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira' series.", "status": "out_of_scope" }, { "stage": "lateral-movement-tunneling", "reason": "Belongs to another part of the 'From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira' series.", "status": "out_of_scope" }, { "stage": "data-exfiltration-filezilla", "reason": "Belongs to another part of the 'From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira' series.", "status": "out_of_scope" }, { "stage": "impact-ransomware-deployment", "reason": "Belongs to another part of the 'From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira' series.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "SEO Poisoning for Trojanized Installers", "slug": "initial-access-seo-poisoning", "tactic": "initial-access", "techniques": [ "T1566.002", "T1583.008" ], "observables": [ "opmanager.pro", "zenmap.pro", "download-center.online", "soft-hub.pro", "download-server.online", "soft-server.online", "ip-scanner.org", "84.32.84.32", "url_path contains '/Get?q='" ] }, { "name": "DLL Side-loading of Bumblebee Loader", "slug": "execution-sideloaded-loader", "tactic": "execution", "techniques": [ "T1204.002", "T1574.002" ], "observables": [ "ManageEngine-OpManager.msi", "Advanced-IP-Scanner.msi", "consent.exe executed from AppData", "msimg32.dll side-loaded", "ApplicationInstallationFolder_11", "Signer: LLC Resource+", "Signer: LLC Vector" ] }, { "name": "Persistent C2 and Access Management", "slug": "persistence-c2-establishment", "tactic": "persistence", "techniques": [ "T1136.002", "T1543.003", "T1105" ], "observables": [ "14-char .org DGA domains", "AdgNsy.exe (renamed wab.exe)", "RustDesk service installation", "New Enterprise Admin accounts" ] }, { "name": "Network Discovery and Credential Harvesting", "slug": "discovery-credential-dumping", "tactic": "credential-access", "techniques": [ "T1003.001", "T1003.003", "T1082", "T1018", "T1059.001" ], "observables": [ "systeminfo", "nltest", "wbadmin.exe to extract ntds.dit", "lsassy utility", "pOWerShELl.exE (mixed-case obfuscation)", "PowerShell scripts for Veeam credential decryption" ] }, { "name": "Lateral Movement and Tunneling", "slug": "lateral-movement-tunneling", "tactic": "lateral-movement", "techniques": [ "T1021.001", "T1572", "T1562.010" ], "observables": [ "Reverse SSH tunnel", "RDP proxying over SSH", "BYOVD driver usage to neutralize EDR" ] }, { "name": "Data Exfiltration via SFTP", "slug": "data-exfiltration-filezilla", "tactic": "exfiltration", "techniques": [ "T1048.003" ], "observables": [ "FileZilla execution", "SFTP traffic to Ukrainian server", "75GB of data exfiltrated", "SYSVOL and file share exfiltration" ] }, { "name": "Akira Ransomware Deployment", "slug": "impact-ransomware-deployment", "tactic": "impact", "techniques": [ "T1486", "T1490" ], "observables": [ "locker.exe (Akira binary)", "WMI shadow copy deletion", "Volume Shadow Copy deletion via vssadmin" ] } ], "summary": "Bumblebee malware was delivered via SEO poisoning using trojanized installers for enterprise software like ManageEngine OpManager. The threat actor established persistence with RustDesk and AdaptixC2, performed deep credential harvesting (NTDS.dit and Veeam), and exfiltrated over 75GB of data before deploying Akira ransomware." }, "severity": "high", "rationale": "The hunt focuses on hosts running ManageEngine or Advanced IP Scanner, typically servers or IT administrator workstations. The infection chain begins with a user search, so start by identifying hosts with these software packages in the scoping query.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An intruder has delivered Bumblebee malware through a trojanized MSI installer via SEO poisoning, using DLL side-loading of consent.exe and establishing persistence with remote management tools like RustDesk.", "parameters": { "scope_hosts": { "type": "list[host]", "default": [], "description": "Hostnames identified in the scoping step to narrow subsequent behavioral queries; leave empty to hunt the whole estate." }, "lookback_days": { "type": "number", "default": "14", "description": "Days of history to examine." }, "seo_c2_domains": { "from": { "ref": "https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/", "kind": "article", "observed": "2025-07-01" }, "type": "list[domain]", "default": [ "opmanager.pro", "zenmap.pro", "download-center.online", "soft-hub.pro", "download-server.online", "soft-server.online", "netml.shop", "ip-scanner.org" ], "description": "Known impersonation and C2 domains identified in the campaign." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/", "gates": [ "dry-run", "lint" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/", "name": "From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira" } ], "blind_spots": [ { "id": "no-process-logs", "risk": "A host without an agent contributes no process rows, allowing the side-loading execution to go unnoticed.", "stage": "execution-sideloaded-loader", "question": "whether consent.exe was executed on hosts missing an agent", "requires": "hb_process_activity on all servers" }, { "id": "no-dns-logs", "risk": "If DNS is encrypted or bypasses the monitored resolver, the initial lure connection will be invisible.", "stage": "initial-access-seo-poisoning", "question": "whether connection attempts to SEO domains occurred", "requires": "hb_dns_activity covering endpoint resolvers" }, { "id": "no-inventory-visibility", "risk": "If inventory is incomplete, the hunt may miss hosts that are running the impersonated management tools.", "question": "whether all potential targets of the campaign were scoped", "requires": "hb_software_inventory coverage for the entire server estate" } ] }, "name": "Bumblebee Delivery and Persistence", "description": "This hunt identifies the initial stages of a Bumblebee infection. The hunt first scopes the environment for vulnerable software, then identifies a behavioral lead: the adversary executing consent.exe from AppData. If a lead is confirmed, the hunt fans out to search for campaign-specific C2/SEO infrastructure and rare persistence mechanisms, including renamed Windows utilities and unauthorized remote access services. An analyst then weighs the evidence to confirm the breach." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira", "index": 1, "title": "From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira", "total": 2 }, "coverage": [ { "stage": "initial-access-seo-poisoning", "steps": [ "campaign-dns-activity" ], "status": "covered" }, { "stage": "execution-sideloaded-loader", "steps": [ "detect-sideloading-lead" ], "status": "covered" }, { "stage": "persistence-c2-establishment", "steps": [ "rare-persistence-prevalence" ], "status": "covered" }, { "stage": "discovery-credential-dumping", "reason": "Belongs to another part of the 'From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira' series.", "status": "out_of_scope" }, { "stage": "lateral-movement-tunneling", "reason": "Belongs to another part of the 'From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira' series.", "status": "out_of_scope" }, { "stage": "data-exfiltration-filezilla", "reason": "Belongs to another part of the 'From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira' series.", "status": "out_of_scope" }, { "stage": "impact-ransomware-deployment", "reason": "Belongs to another part of the 'From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira' series.", "status": "out_of_scope" } ], "rationale": "An intruder has delivered Bumblebee malware through a trojanized MSI installer via SEO poisoning, using DLL side-loading of consent.exe and establishing persistence with remote management tools like RustDesk.", "blind_spots": [ { "id": "no-process-logs", "risk": "A host without an agent contributes no process rows, allowing the side-loading execution to go unnoticed.", "stage": "execution-sideloaded-loader", "question": "whether consent.exe was executed on hosts missing an agent", "requires": "hb_process_activity on all servers" }, { "id": "no-dns-logs", "risk": "If DNS is encrypted or bypasses the monitored resolver, the initial lure connection will be invisible.", "stage": "initial-access-seo-poisoning", "question": "whether connection attempts to SEO domains occurred", "requires": "hb_dns_activity covering endpoint resolvers" }, { "id": "no-inventory-visibility", "risk": "If inventory is incomplete, the hunt may miss hosts that are running the impersonated management tools.", "question": "whether all potential targets of the campaign were scoped", "requires": "hb_software_inventory coverage for the entire server estate" } ], "scoping_notes": "The hunt focuses on hosts running ManageEngine or Advanced IP Scanner, typically servers or IT administrator workstations. The infection chain begins with a user search, so start by identifying hosts with these software packages in the scoping query.", "beyond_detection": "A simple rule might catch consent.exe in a user path, but this hunt correlates that event with search-engine poisoning infrastructure and rare persistence tools like RustDesk, reducing false positives from legitimate software testing while providing full breach context." } }, { "id": "find-vulnerable-software", "type": "query", "label": "Scope hosts with target management software", "config": { "dsl": "sqlite", "role": "scoping", "source": "endpoint", "content": "SELECT device_hostname, package_name, package_version FROM hb_software_inventory WHERE LOWER(package_name) LIKE '%manageengine opmanager%' OR LOWER(package_name) LIKE '%advanced ip scanner%'", "surface": "hb_software_inventory", "description": "Identify hosts running the management software that was impersonated in the SEO poisoning campaign.", "expected_signal": "A list of hosts that use these management tools, making them high-fidelity targets for this campaign. Silence means no known targets exist in current inventory." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Scope hosts with target management software", "reads": [ "device_hostname", "package_name", "package_version" ], "source": "hb_software_inventory", "target": "endpoint", "content": "SELECT device_hostname, package_name, package_version FROM hb_software_inventory WHERE LOWER(package_name) LIKE '%manageengine opmanager%' OR LOWER(package_name) LIKE '%advanced ip scanner%'", "silence": "not_evidence_of_absence", "expected": "A list of hosts that use these management tools, making them high-fidelity targets for this campaign. Silence means no known targets exist in current inventory.", "verified": "dry-run", "verified_at": "2026-09-23" } }, { "id": "detect-sideloading-lead", "type": "query", "label": "Anomalous consent.exe side-loading", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT device_hostname, process_name, process_path, process_cmd_line, time FROM hb_process_activity WHERE (LOWER(process_name) = 'consent.exe' AND LOWER(process_path) NOT LIKE 'c:\\\\windows\\\\system32\\\\%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_process_activity", "description": "Find the primary execution signal for the Bumblebee loader: consent.exe running from non-system paths.", "expected_signal": "Any execution of consent.exe outside the System32 directory, which strongly indicates a DLL side-loading attempt. Silence proofs the specific binary lure was not seen." }, "parents": [ { "id": "find-vulnerable-software" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "Anomalous consent.exe side-loading", "reads": [ "device_hostname", "process_name", "process_path", "process_cmd_line", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT device_hostname, process_name, process_path, process_cmd_line, time FROM hb_process_activity WHERE (LOWER(process_name) = 'consent.exe' AND LOWER(process_path) NOT LIKE 'c:\\\\windows\\\\system32\\\\%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "evidence_of_absence", "expected": "Any execution of consent.exe outside the System32 directory, which strongly indicates a DLL side-loading attempt. Silence proofs the specific binary lure was not seen.", "verified": "dry-run", "verified_at": "2026-09-23" } }, { "id": "evaluate-lead", "type": "analytic", "label": "Evaluate side-loading lead", "config": { "cite": "required", "tools": [ "endpoint" ], "context": [ "detect-sideloading-lead" ], "objective": "Determine if the execution of consent.exe indicates an unauthorized Bumblebee loader execution by checking the path and parent process context.", "description": "Analyze the lead query results to confirm a malicious side-loading pattern.", "max_iterations": 3, "expected_signal": "A per-host verdict on whether the process activity matches the trojanized MSI deployment pattern.", "success_criteria": "A verdict of suspicious or malicious for any host exhibiting anomalous path behavior." }, "parents": [ { "id": "detect-sideloading-lead" } ] }, { "id": "gate-on-lead", "type": "checkpoint", "label": "Gate on lead confirmation", "config": { "fuzzy": true, "judge": "hunter", "question": "the evaluate-lead verdict is suspicious or malicious for at least one host", "condition": "the evaluate-lead verdict is suspicious or malicious for at least one host", "blind_spot": "no-process-logs", "confidence": "high", "description": "Route the hunt to expensive deeper queries only if the initial side-loading lead is confirmed.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "evaluate-lead" } ] }, { "id": "campaign-dns-activity", "type": "query", "label": "Campaign SEO and delivery DNS hits", "config": { "dsl": "sqlite", "role": "enrichment", "source": "endpoint", "content": "SELECT device_hostname, query_hostname, process_name, COUNT(*) AS lookups, MIN(time) AS first_seen FROM hb_dns_activity WHERE instr(',' || '{{seo_c2_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, query_hostname, process_name", "surface": "hb_dns_activity", "description": "Identify connections to the impersonation domains used for SEO poisoning and initial payload delivery.", "expected_signal": "DNS resolutions of known malicious delivery domains, confirming the host was lured by the SEO campaign." }, "parents": [ { "id": "gate-on-lead", "branch": "on_supports" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "Campaign SEO and delivery DNS hits", "reads": [ "device_hostname", "query_hostname", "process_name", "time" ], "source": "hb_dns_activity", "target": "endpoint", "content": "SELECT device_hostname, query_hostname, process_name, COUNT(*) AS lookups, MIN(time) AS first_seen FROM hb_dns_activity WHERE instr(',' || '{{seo_c2_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, query_hostname, process_name", "silence": "not_evidence_of_absence", "expected": "DNS resolutions of known malicious delivery domains, confirming the host was lured by the SEO campaign.", "verified": "dry-run", "verified_at": "2026-09-23" } }, { "id": "rare-persistence-prevalence", "type": "query", "label": "Rare persistence binaries and renamed tools", "config": { "dsl": "sqlite", "role": "baseline", "source": "endpoint", "content": "SELECT device_hostname, LOWER(process_path) AS path, COUNT(*) AS runs, MIN(time) AS first_seen FROM hb_process_activity WHERE (LOWER(process_path) LIKE '%\\\\appdata\\\\%' OR LOWER(process_name) = 'adgnsy.exe' OR LOWER(process_cmd_line) LIKE '%rustdesk%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, LOWER(process_path) ORDER BY runs ASC", "surface": "hb_process_activity", "description": "Stack-count rare binaries in AppData and identify renamed utilities like AdgNsy.exe or unauthorized RustDesk activity.", "expected_signal": "Identification of AdgNsy.exe or RustDesk on scoped hosts, or rare binaries residing in AppData paths used by Bumblebee." }, "parents": [ { "id": "gate-on-lead", "branch": "on_supports" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Rare persistence binaries and renamed tools", "reads": [ "device_hostname", "process_path", "process_name", "process_cmd_line", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT device_hostname, LOWER(process_path) AS path, COUNT(*) AS runs, MIN(time) AS first_seen FROM hb_process_activity WHERE (LOWER(process_path) LIKE '%\\\\appdata\\\\%' OR LOWER(process_name) = 'adgnsy.exe' OR LOWER(process_cmd_line) LIKE '%rustdesk%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, LOWER(process_path) ORDER BY runs ASC", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "Identification of AdgNsy.exe or RustDesk on scoped hosts, or rare binaries residing in AppData paths used by Bumblebee.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "path" ], "rare_below": 3 }, "verified_at": "2026-09-23" } }, { "id": "final-triage", "type": "analytic", "label": "Synthesize Bumblebee infection evidence", "config": { "cite": "required", "tools": [ "endpoint" ], "context": [ "evaluate-lead", "campaign-dns-activity", "rare-persistence-prevalence" ], "objective": "Confirm if any host has been successfully compromised by correlating the anomalous execution of consent.exe with subsequent network infrastructure matches and rare binary persistence.", "description": "Synthesize the lead verdict, DNS hits, and process prevalence to confirm a Bumblebee breach.", "max_iterations": 6, "expected_signal": "A detailed verdict per host citing the side-loaded binary, network hits, and rare persistence mechanisms.", "success_criteria": "A verdict citing specific rows from at least two surfaces for any host determined to be malicious, explicitly correlating the host identified in detect-sideloading-lead with the findings from subsequent steps." }, "parents": [ { "id": "campaign-dns-activity", "kind": "merge" }, { "id": "rare-persistence-prevalence", "kind": "merge" } ] }, { "id": "route-on-verdict", "type": "checkpoint", "label": "Route on final triage", "config": { "fuzzy": true, "judge": "hunter", "question": "the final-triage verdict is malicious for at least one host", "condition": "the final-triage verdict is malicious for at least one host", "blind_spot": "no-dns-logs", "confidence": "high", "description": "Initiate response for confirmed infections or review for suspicious findings.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "final-triage" } ] }, { "id": "isolate-host", "type": "action", "label": "Isolate host", "config": { "target": "endpoint", "description": "Contain the threat before the intruder moves to data exfiltration or Akira ransomware deployment.", "instructions": "Isolate the host from the network. Collect the contents of ApplicationInstallationFolder_11 and dump the memory of any anomalous consent.exe processes for forensic analysis.", "action_approval": "required" }, "parents": [ { "id": "route-on-verdict", "branch": "on_supports" } ] }, { "id": "analyst-review", "type": "task", "label": "Forensic review of accounts and tunnels", "config": { "assignee": "analyst", "description": "Manually review the cited rows and investigate subsequent lateral movement or credential creation.", "instructions": "Review the cited rows. Search hb_auth_signin for unauthorized Enterprise Admin accounts. Verify hb_network_connection for reverse SSH tunnels (e.g., port 22 to non-standard external IPs) used to proxy RDP." }, "parents": [ { "id": "gate-on-lead", "branch": "default" }, { "id": "gate-on-lead", "branch": "on_unavailable" }, { "id": "route-on-verdict", "branch": "default" }, { "id": "route-on-verdict", "branch": "on_unavailable" }, { "id": "isolate-host" } ] }, { "id": "close-out", "type": "task", "label": "Close out", "config": { "assignee": "analyst", "description": "Finalize the hunt and document findings.", "instructions": "Document the findings. If no malicious activity was found, record the lookback window and the specific domains searched. Recommend promoting the consent.exe path check to a standing detection rule." }, "parents": [ { "id": "gate-on-lead", "branch": "on_refutes" }, { "id": "route-on-verdict", "branch": "on_refutes" } ] } ] }