Akira/Bumblebee: NTDS.dit Extraction via wbadmin Loopback SMB Backup

Duo Tech@duotech

•updated Jun 29, 2026•0•0•1

Detects the use of wbadmin.exe to initiate a system backup that targets sensitive Active Directory and registry files (NTDS.dit, SYSTEM, and SECURITY hives) to a local SMB share on the loopback address. This technique is used by threat actors to stage critical credential material for offline extraction and cracking.