Akira/BumbleBee: RustDesk Persistent Service Deployment with C2 Artifact Correlation

Ibrahim Saud@tektrix

•updated Jun 29, 2026•1•0•2

This rule detects the deployment and execution of the RustDesk remote access tool in conjunction with potential staging of installation artifacts and observed prior activity related to BumbleBee/Adaptix C2. It correlates process execution, file creation, and network connectivity to the RustDesk relay infrastructure to assign a risk score, helping identify potential unauthorized remote access or malicious persistence.