Up a Creek Without a Command Line: Mapping an Akira Ransomware Attack

Acknowledgments: Special thanks to Dray Agha for his extensive contributions to this investigation.

Background

In September, the Huntress agent was deployed on an organization that had been targeted in an Akira ransomware attack. As we've written about previously, the Huntress agent is sometimes deployed after an attacker had already accessed or compromised the environment. This sometimes happens in response to an incident; other times an organization is still rolling out the agent when the compromise is discovered.

Regardless, a post-compromise agent…