cyber.hendryadrian.com
Security News · huntress.com

Huntress Says Managed EDR Stopped Akira Ransomware From Encrypting Fire Department Files

· Original article ↗

Summary

Huntress says its Managed EDR Attack Disruption Engine repeatedly killed an Akira encryptor targeting a fire department’s network shares, preventing file encryption. The company says the engine runs locally and sends accelerated alerts to its SOC.

Key points

  • Huntress says some ransomware attacks can unfold in under 15 minutes, with its SOC detecting cases that took less than five minutes.
  • The Attack Disruption Engine runs locally in Huntress’s EDR agent and monitors endpoint activity for anomalous attacker behavior.
  • When it detects suspicious activity, the engine can kill processes, stop code execution and prevent attackers from establishing footholds, while alerting Huntress’s SOC.
  • In a reported attack on a fire department, the attacker attempted to disable EDR, scoped remote shares and deleted shadow copies before launching Akira ransomware.
  • Huntress says the engine killed the Akira encryptor each time it was launched against a share, preventing files from being encrypted.

Article Details

Event Type
Huntress announced the Attack Disruption Engine in Managed EDR and described its use in disrupting an Akira ransomware attack.
Impact
In a reported incident targeting a fire department’s IT systems, the engine repeatedly terminated the Akira encryptor process before it could encrypt files on remote shares, preventing file encryption and minimizing organizational impact. Huntress says the engine also takes disruptive action against anomalous attacker behavior and accelerates alerts to its SOC.

MITRE ATT&CK

T1486 · Data Encrypted for ImpactThe attacker launched the Akira encryptor against remote-share targets; the engine stopped it before any files were encrypted.T1490 · Inhibit System RecoveryThe attacker deleted shadow copies during the Akira ransomware attack, which the article describes as a measure to prevent recovery of encrypted files.

People

Jonathan JohnsonHuntress Windows EDR Product Researcher associated with development of the Attack Disruption Engine.Toby BussaBylined author of the article.

Malware

AkiraWrecking Akira ransomwareProtonFigure 1: Timeline of events where Proton ransomware was deployed

Vendors

HuntressHomeBlog Disrupting Endpoint Attacks with Huntress Managed EDRMicrosoftsystems! The attacker landed on an endpoint and launched an EDR killer to try to blind the SOC, which Microsoft Defender Antivirus detected and quarantined.

Products

Managed EDRHomeBlog Disrupting Endpoint Attacks with Huntress Managed EDRMicrosoft Defender AntivirusThe attacker landed on an endpoint and launched an EDR killer to try to blind the SOC, which Microsoft Defender Antivirus detected and quarantined.

Industries

Fire departmentransomware attacks. Here’s a real-world example from the Huntress SOC where an adversary targeted a fire department’s IT systems! The attacker landed on an endpoint and launched an EDR killer to try to blind the SOC,

Related Articles