What Is Ransomware?

Akira's encryptor runs as w.exe, appends .akira or .powerranges to the files it touches, and drops akira_readme.txt into C:\ and each user's home directory under C:\Users. CISA documented all three artifacts in AA24-109A. Every one of them is useless to a defender, because by the time that binary starts, the operator has already been in the network for days.

Ransomware is not a malware problem. It is an intrusion that ends in encryption, and the encryption is the receipt. We have not detonated any of these families in a lab, so everything here comes from public advisories and public rule sets, cited where it matters.

The operating model

Modern ransomware is a service business with three separate roles. The operator writes the encryptor, runs the leak site and handles negotiation. Affiliates do the intrusion work and take the larger cut. Initial access brokers sell the first foothold, usually valid VPN or RDP credentials, to whichever affiliate wants it.

CISA describes RansomHub as a ransomware-as-a-service variant, formerly known as Cyclops and Knight, that attracted affiliates from LockBit and ALPHV after those brands were disrupted. That churn matters for detection. The encryptor changes brand, the affiliate tradecraft does not. The same Impacket, the same AnyDesk, the same nltest.

Double extortion is the second half of the model. Maze, first seen in May 2019, paired encryption with data theft and published stolen data to force payment. Today the theft is the leverage. An organization with clean offline backups can restore and still pay, because the affiliate holds a copy of the payroll database. The exfiltration happens before the encryption, which makes it the last cheap place to catch the intrusion.

Initial access

Akira affiliates got in through VPN appliances without MFA, exploiting CVE-2020-3259 and CVE-2023-20269 on Cisco products and CVE-2024-40766 on SonicWall. They also brute-forced VPN and SSH endpoints and used SharpDomainSpray for password spraying. RansomHub affiliates used phishing, public-facing exploitation and password spraying against credentials from old breaches.

Telemetry is the VPN or identity provider log, not the endpoint. Nothing has run yet. The artifact is a successful VPN authentication with no MFA assertion, from an ASN the tenant has never seen, followed within minutes by Security event 4624 logon type 3 on a file server. The same success preceded by a burst of 4625 failures across many distinct usernames is password spraying that worked.

Credential access

Akira uses Kerberoasting and LSASS memory access to get credentials, plus Mimikatz and LaZagne, and dumps SAM and NTDS.dit outright.

Sysmon is the source here. Event ID 10 (ProcessAccess) with TargetImage ending in \lsass.exe and a GrantedAccess value of 0x1010 or 0x1410 is the standard read-and-dump pattern. The LOLBin version leaves a clean process creation:

rundll32.exe C:\Windows\System32\comsvcs.dll MiniDump 624 C:\Windows\Temp\l.dmp full

Kerberoasting shows up in Security event 4769 as a run of service ticket requests from one account, many distinct service names, ticket encryption type 0x17. RC4 requests in an environment that otherwise negotiates AES are the signal.

Discovery

This stage is entirely LOLBins and free tools, which is why it drowns in noise unless you baseline it. Akira operators run AdFind.exe against Active Directory, nltest /DOMAIN_TRUSTS for trusts, net commands for groups, and Advanced IP Scanner or SoftPerfect NetScan for the network sweep.

Process creation telemetry (Security 4688 with command line auditing on, or Sysmon 1) is the only place this lands. No single command is worth an alert. Three or more from the same parent inside a short window is:

nltest /DOMAIN_TRUSTS
net group "Domain Admins" /domain
whoami /groups

A helpdesk admin runs one. Nobody runs the set in ninety seconds.

Lateral movement

Akira abuses RDP, SSH and VNC, and runs Impacket's wmiexec.py for remote command execution. Impacket is loud if you look. On the target, wmiexec spawns a cmd.exe that redirects its output to \\127.0.0.1\ADMIN$\ with a hex timestamp filename. No administrator produces that by hand.

Collect Security 4624 type 3 (network) and type 10 (RemoteInteractive), plus System event 7045 for service installs. PsExec-style movement leaves a 7045 for a service whose image path sits in C:\Windows\ under a random four-character name. A domain admin logging on interactively to twenty workstations in an hour is the same signal expressed as volume.

Killing the security tooling

Bring-your-own-vulnerable-driver is the current standard. CISA reports Akira deploying POORTRY, a signed but vulnerable Windows driver, to get kernel privileges, and separately using PowerTool against the Zemana AntiMalware driver to terminate antivirus processes. Sophos documented EDRKillShifter, used by a RansomHub affiliate, which side-loads a vulnerable driver for the same purpose. Akira affiliates also just uninstall the EDR agent.

Sysmon event ID 6 (DriverLoaded) for a driver signed by a vendor with no business on the host is the highest-value artifact in this post, because almost nothing legitimate generates it. Pair it with System 7045 where the service is a kernel driver loaded from C:\Windows\Temp or a user profile. Microsoft Defender events 5001 (real-time protection disabled) and 5007 (configuration changed) are worth alerting on unconditionally. If your EDR stops reporting from a host that still answers pings, treat the silence as the alert.

Backup destruction

Akira operators exploit Veeam Backup and Replication vulnerabilities for privilege escalation and pull stored credentials out of the Veeam configuration database. The same session that took the domain takes the backup infrastructure. Watch for net stop against backup service names, deletion of repository files, and the backup catalog going away:

wbadmin.exe delete catalog -quiet
bcdedit.exe /set {default} recoveryenabled no
vssadmin.exe delete shadows /all /quiet

Staging and exfiltration

Akira affiliates collect with FileZilla and WinRAR, then move data out with WinSCP and Rclone over FTP, SFTP and cloud storage services including Mega. They use AnyDesk, RustDesk, MobaXterm, LogMeIn and Cloudflare Tunnel for access, and Ngrok for tunnels.

Sysmon 11 (FileCreate) for a multi-gigabyte .7z or .rar written into C:\Users\Public or C:\Windows\Temp is the staging artifact. Sysmon 3 (NetworkConnect) and 22 (DnsQuery) catch the egress: a file server resolving mega.nz is not normal. Match Rclone on OriginalFileName rather than Image, since the PE metadata usually survives a rename.

What the rule catches

The strongest single rule for this kill chain is also the latest one, and we are going to be honest about that trade. Here is the SigmaHQ rule verbatim, proc_creation_win_susp_shadow_copies_deletion.yml:

title: Shadow Copies Deletion Using Operating Systems Utilities
id: c947b146-0abc-4c87-9c64-b17e9d7274a2
status: stable
description: Shadow Copies deletion using operating systems utilities
author: Florian Roth (Nextron Systems), Michael Haag, Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community, Andreas Hunkeler (@Karneades)
date: 2019-10-22
modified: 2022-11-03
tags:
    - attack.impact
    - attack.stealth
    - attack.t1070
    - attack.t1490
logsource:
    category: process_creation
    product: windows
detection:
    selection1_img:
        - Image|endswith:
              - '\powershell.exe'
              - '\pwsh.exe'
              - '\wmic.exe'
              - '\vssadmin.exe'
              - '\diskshadow.exe'
        - OriginalFileName:
              - 'PowerShell.EXE'
              - 'pwsh.dll'
              - 'wmic.exe'
              - 'VSSADMIN.EXE'
              - 'diskshadow.exe'
    selection1_cli:
        CommandLine|contains|all:
            - 'shadow'
            - 'delete'
    selection2_img:
        - Image|endswith: '\wbadmin.exe'
        - OriginalFileName: 'WBADMIN.EXE'
    selection2_cli:
        CommandLine|contains|all:
            - 'delete'
            - 'catalog'
            - 'quiet'
    selection3_img:
        - Image|endswith: '\vssadmin.exe'
        - OriginalFileName: 'VSSADMIN.EXE'
    selection3_cli:
        CommandLine|contains|all:
            - 'resize'
            - 'shadowstorage'
        CommandLine|contains:
            - 'unbounded'
            - '/MaxSize='
    condition: (all of selection1*) or (all of selection2*) or (all of selection3*)
falsepositives:
    - Legitimate Administrator deletes Shadow Copies using operating systems utilities for legitimate reason
    - LANDesk LDClient Ivanti-PSModule (PS EncodedCommand)
level: high

What it catches: shadow copy deletion through vssadmin, wmic, diskshadow, PowerShell and wbadmin, plus the quieter variant where the operator resizes shadow storage to force existing copies out instead of deleting them. It matches on OriginalFileName as well as Image, so renaming vssadmin.exe does not evade it.

What it misses: everything before it. It fires minutes before encryption, so it is a containment trigger, not an early warning. It also misses shadow copy deletion performed through the VSS API directly rather than a command line, and REAgentC.exe disabling the recovery environment, which MITRE lists under T1490 but this rule does not cover.

False positives are real and the rule authors list them. Backup software and management agents legitimately resize shadow storage, and LANDesk and Ivanti PowerShell modules trip it. Tune by allowlisting specific parent process and command line pairs, not by dropping the rule. We keep it despite the timing, and so should you, because operators keep running these commands and a high-fidelity alert forty seconds out is still the difference between one server and the estate. For how to reason about that trade-off, see /blog/what-is-detection-engineering.

Encryption mechanics

Akira uses a ChaCha20 stream cipher for the file data and RSA for the key exchange, and varies full versus partial encryption based on file type and size. That hybrid shape is near universal across families. A symmetric key encrypts the bytes because it is fast, then the operator's public key wraps that symmetric key.

The private key never touches the victim network, and the symmetric key is discarded once wrapped. Pulling the sample apart after the fact recovers nothing. Key recovery happens only when the operator's implementation is broken or law enforcement seizes the keys, and neither is something you can plan around. Partial encryption exists to shorten the window between the first encrypted file and the last, which is the window your detection has to fit inside.

Recovery reality

Backups that were reachable from the compromised domain are not backups. A Veeam server joined to the same Active Directory, running under a domain admin service account, sits in the same blast radius as everything it protects.

The property that survives is not "we have backups". It is "the credential that encrypted the estate cannot delete this copy". Offline media, immutable object storage with a retention lock, or a separate identity domain. Then test the restore, because an untested backup is a hypothesis.

ATT&CK mapping

Summary

Ransomware detection is intrusion detection with a deadline. The encryptor is the only stage that is trivially detectable and the only stage where detection no longer helps, so the budget belongs in credential access, discovery, lateral movement and exfiltration. Shadow copy deletion is worth keeping as a last-resort containment trigger, because operators keep doing it, but a program that only catches T1490 is a program that catches ransomware after it has won. Assume every backup reachable with domain credentials is already gone, and design the recovery path around the one copy that is not.

Collect these before you write another rule:

Security 4624 (types 3 and 10), 4625, 4688 with command line auditing
Security 4769 (ticket encryption type), 4720, 4728
System 7045 (service and driver installs)
Sysmon 1, 3, 6, 10, 11, 22
Microsoft-Windows-Windows Defender/Operational 5001, 5007
PowerShell/Operational 4104 (script block logging)
VPN and identity provider authentication logs with MFA assertion status
Outbound byte volume per host, baselined

Browse the catalog for the stages above at /rules?q=ransomware, or filter the whole Windows set at /rules?domain=windows.