Akira ransomware
Named by 2 kept items in this workspace.
1 items name it under classification.key entities and 1 under threat actors.
Search every workspace for Akira ransomware. It matches the name as written, so it can find other things that share it.
The items that name it 2
Ransomware deployed rapidly across the victim environment following initial access via SonicWall VPN exploitation; running binary observed as w.exe from a user's desktop, used to encrypt a workstation before mass isolation prevented full environment encryption.
All threat actors in this workspace.