Huntress Details Activity Observed Before Akira Ransomware Deployments
Summary
Huntress analysts describe activity seen before Akira ransomware deployments, including new accounts, RDP access, hidden accounts, Cloudflared tunnels, and ransomware execution. They recommend asset inventory, attack-surface reduction, and monitoring.
Key points
- Huntress observed threat actors creating accounts through network connections or exposed MSSQL servers, sometimes using Veeam installations.
- Attackers sometimes used already-compromised accounts for endpoint access and could enable RDP; Huntress notes the enabling command is not unique to Akira.
- A command observed in December 2023 hid a designated account from the Windows Welcome screen.
- Huntress saw RDP access associated with workstation name WIN-JGRMF8L11HO in security event records across multiple incidents, several confirmed as Akira infections.
- Analysts observed Cloudflared tunnels on some endpoints and documented a command line used to launch Akira encryption malware.
- Huntress recommends asset inventories, attack-surface reduction, and monitoring for indicators of early attack activity.
Article Details
- Attack Vectors
- Threat actors created new user accounts through type 3 network connections, lateral movement, or access to exposed MSSQL servers, including servers running as part of Veeam installations.
- Already-compromised accounts were used to log into endpoints, sometimes after RDP had been enabled.
- A command was used in a December 2023 incident to hide a designated account from the Windows Welcome screen.
- Cloudflared tunnels were installed on some endpoints within customer infrastructure.
- Akira file-encryption malware was deployed with the command line C:\ProgramData\w.exe -p=<path> -n=2.
- Defensive Notes
- Huntress recommends maintaining a thorough inventory of endpoints and exposed services, reducing the attack surface, and monitoring with MDR and SIEM.
- Monitor for and update indicators associated with early attack stages to inhibit or prevent follow-on activity.
- Huntress notes that incomplete agent coverage, agent installation after encryption, and older Windows versions can limit incident visibility.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | 3b7fc61649badd73986a86d39124b69aa2c7b6ecdb1d448137080579dc4990f2 | SHA-256 hash for one instance of the Akira file-encryption executable w.exe. |
MITRE ATT&CK
T1021.001 · Remote Desktop ProtocolThreat actors used RDP to access endpoints, sometimes after enabling RDP.T1136.001 · Local AccountThreat actors created new user accounts during attacks that led to Akira deployment.T1136.002 · Domain AccountThe article describes account creation through access to exposed MSSQL servers; it does not specify that the accounts were domain accounts.T1564.002 · Hidden UsersA command observed in December 2023 hid a designated user account from the Windows Welcome screen.