Skip to content
BumbleBee and AdaptixC2 Facilitate Akira Ransomware via Bing SEO Poisoning

BumbleBee and AdaptixC2 Facilitate Akira Ransomware via Bing SEO Poisoning

First seen 30 Jun 2026, 13:59 UTC • •

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •July 1, 2026 at 13:47 UTC
  • •BumbleBee and AdaptixC2 are used to deliver Akira ransomware via Bing SEO poisoning.
  • •The campaign is notable for its efficiency rather than novelty in attack stages.
  • •Previous intrusions linked to this campaign were reported in 2025, indicating ongoing risk.

A sophisticated cyber campaign utilizing BumbleBee and AdaptixC2 has been identified, leveraging Bing SEO poisoning to deliver Akira ransomware. This method transforms trusted search traffic into a vector for enterprise compromise. The attack is not characterized by any novel techniques but rather by the efficiency of its execution across multiple stages. The campaign has been linked to previous intrusions reported in 2025, indicating a persistent threat. Organizations relying on Bing for search traffic may be particularly vulnerable to this attack vector. Current mitigation strategies are not detailed, leaving many systems at risk. The attack's scope is significant, affecting potentially numerous enterprises that utilize Bing for search engine optimization.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 101d ago How this analysis works

Timeline

2025-07-01
Threat brief released to customers
A threat brief detailing the Akira ransomware campaign was shared with customers, highlighting the use of BumbleBee and AdaptixC2.
Thedfirreport
2025-08-01
Public flash alert issued
A public flash alert was issued in partnership with Swisscom B2B CSIRT regarding the Akira ransomware campaign.
Thedfirreport
2026-06-30
Current report published
Gbhackers published a report detailing the ongoing use of BumbleBee and AdaptixC2 for Akira ransomware delivery.
Gbhackers

More articles in this cluster (2)

Following this threat?

Track Akira in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed