Loading story…
Threat actors used SEO poisoning to steer victims searching for IT management software to lookalike sites hosting a trojanized ManageEngine OpManager installer, which delivered Bumblebee malware and opened the door to a broader intrusion that culminated in Akira ransomware. Investigators said the attackers used DLL side-loading to launch Bumblebee, then deployed an AdaptixC2 beacon by injecting it into a renamed Windows Address Book binary, linking the activity to a wider campaign also observed by Swisscom involving trojanized IT tool installers such as OpManager and IP scanner software.
After gaining access, the attackers quickly escalated privileges, created domain accounts, moved laterally with RDP and SSH-based tunneling, and stole credentials from Active Directory, LSASS, and Veeam, including dumping NTDS.dit. They established persistence with RustDesk and a reverse SSH tunnel, exfiltrated about 77 GB of data with FileZilla over SFTP and additional SYSVOL data over SSH, then deployed Akira across the root domain roughly 44 hours after compromise before returning to encrypt a child domain; in a related Swisscom case, ransomware was reached in as little as nine hours.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
9 events from the most recent confirmed update back to the earliest known activity.
On 2026-06-30, Gurucul published a write-up on the campaign that included domains, IP addresses, and file hashes as indicators of compromise associated with the intrusion chain.
On 2026-06-29, The DFIR Report published an expanded report with additional technical details on the intrusion, including exfiltration volume, persistence methods, and correlation to parallel activity observed by Swisscom.
The reporting linked the primary intrusion to similar July 2025 incidents observed by Swisscom B2B CSIRT involving trojanized IT tool installers and comparable BumbleBee-to-ransomware tradecraft, indicating a broader campaign.
Two days after the root-domain ransomware deployment, the attackers returned and encrypted systems in a child domain as well.
About 44 hours after the initial compromise in July 2025, the attackers deployed Akira ransomware across the victim's root domain.
During the same July 2025 intrusion, the attackers exfiltrated roughly 77 GB of data using FileZilla over SFTP to a server in Ukraine and also transferred SYSVOL data over SSH.
After initial access in the July 2025 intrusion, the attackers used DLL side-loading to launch BumbleBee, deployed an AdaptixC2 beacon, created privileged domain accounts, and moved laterally while harvesting credentials from Active Directory, Veeam, and LSASS.
In July 2025, threat actors used SEO poisoning around IT management software searches to lure victims to lookalike infrastructure hosting a trojanized ManageEngine OpManager installer, which delivered BumbleBee malware for initial access.
On 2025-08-05, The DFIR Report published a flash alert describing the July 2025 intrusion chain from SEO poisoning and BumbleBee delivery to AdaptixC2 activity and Akira ransomware deployment.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcecommunity.gurucul.com
Open sourcethedfirreport.com
Open sourcethedfirreport.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors are using **software impersonation** and **SEO poisoning** to push victims toward fake download sites for trusted enterprise and IT tools, then delivering malware through trojanized installers. In one campaign, **Storm-2561** used spoofed VPN vendor pages for products such as **Pulse Secure, Fortinet, and Ivanti** to steal enterprise VPN credentials. The malicious packages were hosted on GitHub, signed with a certificate issued to **"Taiyuan Lihua Near Information Technology Co., Ltd."**, and designed to show an error before redirecting victims to the legitimate vendor site, reducing suspicion while exfiltrating credentials. A separate but closely related campaign used fake **FileZilla** download pages to distribute a **Remote Access Trojan** through multi-stage loaders and **DLL sideloading**. Attackers bundled legitimate FileZilla software with a malicious `version.dll`, or dropped the DLL during installation so the malware would execute while the expected application appeared to install normally. Both reports describe the same broader intrusion pattern: adversaries abusing trusted brands, realistic lookalike websites, and legitimate software packaging to compromise users who believe they are downloading authentic tools. A separate **Warlock** intrusion analysis describing web shells, lateral movement, tunneling, and ransomware activity is a different incident and does not match this malware-delivery story.
Jun 29, 2026
Attackers are running an SEO-poisoning campaign that impersonates **Gemini CLI** and **Anthropic Claude Code** installation pages to infect Windows developer workstations with a fileless infostealer. The fake sites closely mimic legitimate setup instructions and trick victims into pasting a PowerShell one-liner that installs the real tool while silently executing malicious code in memory. EclecticIQ said the activity was first observed in early March 2026 and linked the Gemini and Claude lures to the same financially motivated actor through shared malware, infrastructure patterns, and social-engineering themes. The malware disables **ETW** logging and bypasses **AMSI**, then steals credentials, session cookies, OAuth tokens, **CI/CD** secrets, VPN details, SSH material, and files from enterprise and collaboration platforms. It also fingerprints hosts, enumerates processes, dumps Windows Credential Manager data, and can receive follow-on remote code execution tasks from command-and-control servers, raising the risk of broader enterprise and software supply-chain compromise from a single infected developer endpoint. Researchers identified more than 30 related malicious domains and a wider impersonation cluster spoofing **Node.js**, **Chocolatey**, **KeePassXC**, and **Monero**, including infrastructure tied to IP `109.107.170.111` hosted by MIRhosting and domains tailored to U.S. and U.K. victims.
Jun 29, 2026
Sophos reported that a broad **dropper-as-a-service** operation used SEO-poisoned websites posing as sources for cracked software to deliver malware at scale. The infrastructure was tied to a 2021 **Raccoon Stealer** campaign but was also used to distribute multiple payloads, including **CryptBot**, **Glupteba**, click-fraud malware, cryptocurrency miners, and ransomware such as **Conti** and **STOP**. Operators also monetized untargeted visitors through fake alerts, malicious browser extensions, and affiliate redirects, turning pirated-software searches into a multi-purpose criminal revenue stream. Researchers linked parts of the ecosystem to the **InstallUSD** advertising network in Pakistan and to Russian-language install services including **InstallBest**, highlighting an underground market where criminals can buy geographically targeted malware installs. The delivery chain relied on layered redirects, referral proxies, Cloudflare-fronted trackers, short-lived Amazon EC2 download servers, and password-protected archives to evade inspection and security controls. Sophos said one InstallUSD-linked landing host was disrupted after being reported to Cloudflare, but the operators rapidly shifted to modified infrastructure, underscoring the resilience of paid-download malware networks and the risk they pose to organizations when users seek pirated business or consumer software on personal or shared devices.
Jun 29, 2026