Up a Creek Without a Command Line: Mapping an Akira Ransomware Attack | Huntress

What it is

A Huntress forensic case study of a single Akira ransomware intrusion, reconstructed entirely after the fact because the Huntress agent was installed post-compromise (so no live EDR process telemetry existed for the key stages). The value here isn't a new TTP — it's the forensic methodology for reconstructing ransomware activity from residual Windows artifacts when process-level logging was absent.

How it works

The attacker entered via RDP/Terminal Services from a workstation not owned by the victim organization, logged into the BitDefender management console, and stopped four BitDefender services (Update, Integration, Protected, Security) via that console — a GUI/console-based AV disablement rather than a command-line kill. Credential theft used procdump.exe run from C:\PerfLogs against lsass.exe. The GOST (Go Simple Tunnel) proxy tool was deployed roughly four hours after encryption began, launched as svchost.exe from C:\PerfLogs\Temp\ under the SYSTEM account, loading a malicious config.dll — a masquerade technique (legitimate process name, abnormal directory) that Huntress confirmed via VirusTotal hash lookup. RClone was then run from the same C:\PerfLogs folder for exfiltration.

The forensic reconstruction itself relied on "toolmark" artifacts since no process execution logs existed: Registry Shellbags showed folder-browsing behavior, PowerShell Event Logs captured the shadow-copy-deletion command, and Akira's own log files corroborated timing. The repeatable pattern Huntress found: ransomware launch → PowerShell shadow-copy deletion → Akira log file created → attacker checks the encrypted folder in Explorer (visible via Shellbags) to verify success — and this four-step sequence repeated three additional times across different folders.

Preconditions / Affected

Applies to environments where EDR/agent deployment occurs after initial compromise, limiting available telemetry to artifacts rather than live process data. Relevant to organizations exposing RDP and relying on BitDefender (or similar AV with a web/remote management console an attacker could reach once inside).

What to do

• The shadow-copy deletion command observed: powershell.exe -Command Get-WmiObject Win32_Shadowcopy , Remove-WmiObject
• Monitor C:\PerfLogs specifically — it hosted procdump, the GOST-loading svchost.exe/config.dll, and RClone in this incident — for new executables or file creation.
• Restrict/monitor RDP access from unrecognized or unowned source workstations.
• Enforce MFA on any exposed remote access.
• Treat AV management console access/service-stop events (Service Control Manager event ID 7036 for AV services) as a high-priority alert.
• Maintain accurate asset inventory and reduce attack surface to narrow what needs monitoring.

flowchart LR
    A[RDP from unowned workstation] --> B[Access BitDefender console]
    B --> C[Stop AV services]
    C --> D[procdump lsass.exe]
    D --> E[GOST tunnel via fake svchost.exe]
    E --> F[RClone exfiltration]
    F --> G[Launch Akira: PS shadow-copy delete]
    G --> H[Verify encryption via Explorer]
    H -->|repeats x4| G

Caveats

Huntress explicitly notes the lack of EDR telemetry for initial access, earlier reconnaissance, and persistence means parts of the attack chain (e.g., exact initial access vector) remain unconfirmed — the timeline is inferred from artifact correlation (Shellbags, Event Logs, Akira logs), not direct process capture.