Huntress maps an Akira ransomware attack from Registry traces and the ransomware's own logs

The agent recorded none of the evidence that put Akira's ransomware on the host. Huntress worked from Windows Registry artifacts including Shellbags, Windows Event Logs and the log files Akira left on the affected endpoints ^[8]. The Event Logs also named each Bitdefender service as it stopped, under Service Control Manager event 7036 ^[10]. Huntress researchers wrote that "one limited telemetry stream does not mean that there aren't important clues in other places that can build a picture about what happened during the incident" ^[2].

The agent did catch the tunnel. Huntress tied the svchost.exe alert to the launch of GOST ^[7]. GOST is an open-source proxy and tunneling tool written in Go. It supports several protocols with built-in encryption and can chain proxies ^[12]. The attacker installed it for persistence after encryption had already started ^[14]. It sat on a domain controller ^[6]. On that timeline, the intruder set up a way back into the domain after the ransomware had run ^[14].

Parts of the chain are inference. Huntress wrote that procdump.exe was run from C:\PerfLogs "presumably to perform credential theft by dumping the contents of the lsass.exe process" ^[11]. Its researchers say they mapped "some parts of the attack" ^[3]. They also wrote that an earlier install would have shown how the attacker got in ^[15]. The write-up does not identify the victim or the Akira affiliate, and it does not say how the attacker got the RDP access used from the outside workstation ^[1][9].

Huntress has written before that its agent sometimes arrives after an attacker is already inside. Sometimes that is a response to an incident; sometimes the organization is partway through a rollout ^[13]. In this case Huntress calls the shadow copy deletion a common Akira action ^[5].