Akira Ransomware Attack Used LimeWire’s Easyupload for Likely Data Exfiltration
Summary
Huntress reconstructed an Akira attack in which an affiliate created a VM on the victim’s hypervisor, disabled Microsoft Defender, staged files with WinRAR, and likely used Easyupload[.]io to exfiltrate data before deploying ransomware.
Key points
- The attacker accessed a domain controller and hypervisor, then created a VM to stage and launch Akira ransomware; the new VM lacked the organization’s Huntress agent.
- On the VM, the attacker disabled Microsoft Defender, accessed shared folders, and installed WinRAR to archive files.
- The attacker used WinSCP during the initial stages of the incident, apparently to transfer staged data.
- Browser artifacts showed a search for “eayupload” followed by access to Easyupload[.]io; Huntress considers it a likely exfiltration method, but does not confirm that data was uploaded.
- The attacker launched akira.exe against several mounted shares. Huntress recovered the VM’s artifacts and used them with Windows event logs and other telemetry to reconstruct the activity.
- Huntress recommends monitoring for unusual or malicious access and for new endpoints created within an environment.
Article Details
- Attack Vectors
- The Akira affiliate accessed the victim’s hypervisor, created a new virtual machine, and used it to stage and launch the ransomware.
- The threat actor accessed the organization’s file server and shares, archived data with WinRAR, and used WinSCP during the initial stages of the incident.
- The actor accessed Easyupload.io, reportedly as a likely means of exfiltrating staged archives.
- Defensive Notes
- Monitor for unusual or malicious access and for the addition or creation of new endpoints, including virtual machines that may not have the organization’s security tooling installed.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | 131877a052f62750d815cf55d4c14f606a26025e3094e1b8bb18bd1668e3beaa | SHA-256 hash of the Akira encryptor file identified in the incident. |
MITRE ATT&CK
T1018 · Remote System DiscoveryThe actor reviewed output files associated with enumerating computers in the organization.T1087.002 · Domain AccountThe actor reviewed output files associated with enumerating Active Directory users.T1486 · Data Encrypted for ImpactThe actor launched the Akira file encryptor against several mounted shares.T1560.001 · Archive via UtilityThe actor used WinRAR to archive the contents of a share folder before staging the data.T1562.001 · Disable or Modify ToolsThe actor disabled Microsoft Defender on the newly created virtual machine.
People
Adam MooneyAcknowledged for contributions to the investigation.Anna PhamAcknowledged for contributions to the investigation.Harlan CarveyNamed with the article’s authors.Lindsey O'Donnell-WelchNamed author of the article.Michael TiggesAcknowledged for contributions to the investigation.Samantha ShawAcknowledged for contributions to the investigation.
Malware
Products
Microsoft Defender Antimalware PlatformOur investigation showed that the attacker quickly progressed through their attack, disabling Microsoft Defender and installing WinRAR, an archival tool typically used by threat actors for staging dataMicrosoft EdgeWe also used telemetry from Windows Event Logs, Microsoft Edge browser history artifacts, and more to piece together what had happened.
Tools
WinRAROur investigation showed that the attacker quickly progressed through their attack, disabling Microsoft Defender and installing WinRAR, an archival tool typically used by threat actors for staging dataWinSCPShortly after, they ran WinSCP, a free, open-source file manager and secure file transfer application, presumably to exfiltrate the staged data.