Skip to content

Back to the catalog

Akira, LimeWire, and the Sour Taste of Data Exfiltration
huntress.comwriteup

Akira, LimeWire, and the Sour Taste of Data Exfiltration

Huntress SOC details an Akira ransomware incident where a threat actor accessed a hypervisor, spun up a new VM (bypassing EDR since it lacked the Huntress agent), disabled Microsoft Defender, and deployed a renamed akira.exe encryptor. Notably, the actor exfiltrated staged WinRAR archives via Easyupload.io, a file-upload service run by the rebranded former peer-to-peer client LimeWire, alongside earlier use of WinSCP for exfiltration.

TL;DR Akira affiliate spun up an EDR-blind VM, disabled Defender, and exfiltrated data via LimeWire's Easyupload.io before deploying akira.exe.
Open original ↗
Document

What it is

A Huntress SOC incident (detected May 29) involving an Akira ransomware affiliate. The distinguishing detail beyond the summary is the tradecraft sequence recovered from the rogue VM and the specific host artifacts left behind — the actor employed no anti-forensics or defense evasion beyond disabling Defender, so Windows Event Logs, Edge history, and toolmarks gave a full timeline.

How it works

The chain, as reconstructed: enumerate AD (output files AdUsers.txt, AdComp.txt, opened in Notepad) → pivot to file server → stage with WinRAR → exfil via WinSCP. Then the actor logged into the hypervisor, created a new VHDX-backed VM with no Huntress agent, disabled Microsoft Defender within minutes, reinstalled WinRAR, renamed a cross-platform Akira encryptor to akira.exe, used Edge → Bing (searching "eayupload") to reach Easyupload.io (a LimeWire-operated upload service) for a second exfil path, then ran the encryptor against mounted shares.

flowchart TD
    A[Compromised env] --> B[Enum + WinRAR + WinSCP exfil<br/>agent-visible]
    A --> C[Access hypervisor]
    C --> D[Create new VM<br/>no EDR agent]
    D --> E[Disable Defender]
    E --> F[Easyupload.io exfil + akira.exe]
    style D fill:#fdd

The rogue VM crosses the visibility boundary: the branch through the hypervisor (right side) is the one that evades tooling deployed only to known endpoints.

Preconditions / Affected

Requires the actor to already hold access to a hypervisor management plane. The blind spot exists wherever EDR is deployed per-endpoint but new VM instances are not automatically enrolled — a newly instantiated VM runs with only default OS tooling (Defender).

What to do

  • Hunt at the hypervisor level, not just endpoint EDR: unexpected new VM/server instances are the tell. Alert on VM creation events on hypervisor hosts.
  • Ensure EDR enrollment is enforced on newly-created VMs, or restrict who can instantiate them.
  • Detection artifacts to hunt for: Notepad opening AdUsers.txt/AdComp.txt, WinRAR install/execution on file servers, and browser history hits to Easyupload.io or Bing queries for upload services.
  • Treat this as part of a broader exfil-tool watchlist Huntress cites from prior incidents: finger.exe, Restic, s5cmd, MegaSYNC, and general cloud storage — not just WinSCP/Easyupload.

Caveats

The impacted endpoint was taken offline early, so initial access was not observed. VM ownership is described as "reportedly" instantiated by the actor; forensic recovery was possible only because the actor employed no anti-forensics — a more careful affiliate would leave far less.

Organisations named here

  • LimeWire

Technologies named here

  • Domain controller
  • Huntress agent
  • Hypervisor
  • Notepad
  • Windows virtual hard disk image
  • WinRAR
  • Microsoft Defender
  • WinSCP
  • Disk Management utility
  • File server
  • Forensic tooling
  • Microsoft Edge
  • Easyupload.io
  • akira.exe
  • finger.exe
  • restic
  • s5cmd
  • MEGASync
  • Hyper-V
  • Huntress
  • Akira ransomware

Techniques named here

  • Unauthorized remote access
  • Hypervisor abuse / rogue VM creation
  • Active Directory enumeration
  • Data archiving prior to exfiltration
  • Data exfiltration via file transfer tools
  • Security tooling disablement
  • Lateral access to shares/folders
  • Ransomware deployment

Threat actors named here

  • Akira
  • Akira ransomware

Related in Threat Intel