Akira ransomware kill chain: VPN brute force to domain admin

27 May 2026 high threat

Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.

Akira intrusion via brute-forced local SSLVPN account escalates to domain admin and encryption within 72 hours, visible only in joined firewall and endpoint logs.

This forensic walkthrough reconstructs a complete Akira ransomware intrusion from perimeter firewall and Windows event logs alone, with no EDR or memory analysis. The attack chain begins with credential stuffing against a deprovisioned-in-AD-but-still-active local SSLVPN account with no MFA, succeeding after a single-source brute force. Post-VPN, the attacker pivots to internal discovery via the jump host: nltest, net group queries for Domain Admins, whoami, and AdFind scanning. Within 24 hours, Kerberoasting against three service accounts appears as a tight cluster of RC4-encrypted EID 4769 events—a reliable detection signature. Lateral movement over two days uses RDP (EID 4624 Logon Type 10) to compromise the file server, both domain controllers, and backup servers. The attacker creates a new account in a non-default OU and runs encoded PowerShell reconnaissance against backup infrastructure and shadow-copy state. The final 12 hours involve Security log clearing (EID 1102), endpoint protection service shutdown (System EID 7036), vssadmin shadow-copy deletion, and encryption across all reachable hosts.

The critical insight is temporal distribution: encryption represents only five percent of dwell time; the remaining 95 percent—discovery, lateral movement, privilege escalation, pre-staging—sits entirely in logs most organizations already retain if they join firewall and endpoint sources by normalized timestamp and source IP. Akira's tradecraft is commodity-level; the intrusion succeeds only because perimeter and endpoint logging are treated as separate problems.

Mentioned in this report

Threat actors Akira

Malware Akira

Detection guidance

Shadow Copy Deletion via Vssadmin

ATT&CK T1490

Detects vssadmin.exe deleting shadow copies, a pre-encryption step to inhibit recovery in Akira and other ransomware intrusions. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Shadow Copy Deletion via Vssadmin
description: Detects vssadmin.exe deleting or resizing shadow copies to inhibit system
  recovery before ransomware encryption. Matches the command-line pattern, not specific
  hosts or accounts.
tags:
- attack.impact
- attack.t1490
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith: \vssadmin.exe
  selection_cli:
    CommandLine|contains|all:
    - delete
    - shadows
  selection_resize:
    CommandLine|contains|all:
    - resize
    - shadowstorage
  condition: selection_img and (selection_cli or selection_resize)
falsepositives:
- Backup or storage administrators intentionally purging shadow copies during maintenance
- Disk cleanup scripts that run vssadmin delete shadows
level: high
id: 6fc9356a-e44f-5b0b-894f-c1e15f799285
status: experimental
author: Vorant
references:
- https://isc.sans.edu/diary/rss/33024

Encoded PowerShell Querying Backup or Shadow Copy State

ATT&CK T1490

Detects PowerShell with encoded commands launched alongside shadow copy or backup related references, matching the attacker's recon against backup infrastructure. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Encoded PowerShell Querying Backup or Shadow Copy State
description: Detects powershell.exe or pwsh.exe launched with an encoded command while
  the command line references shadow copies or backup components, such as Get-WmiObject
  Win32_ShadowCopy or Veeam. Generalises on the flags plus backup keywords, not on
  a specific payload.
tags:
- attack.impact
- attack.t1490
- attack.discovery
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
    - \powershell.exe
    - \pwsh.exe
  selection_enc:
    CommandLine|contains:
    - ' -enc'
    - ' -EncodedCommand'
    - ' -ec '
  selection_backup:
    CommandLine|contains:
    - Win32_ShadowCopy
    - shadowcopy
    - Veeam
    - wbadmin
  condition: selection_img and selection_enc and selection_backup
falsepositives:
- Backup management software invoking encoded PowerShell to query Veeam or VSS state
- Admin monitoring scripts that wrap shadow copy checks in encoded commands
level: medium
id: f76bb591-18a1-57c5-a050-3c3e8354d9c3
status: experimental
author: Vorant
references:
- https://isc.sans.edu/diary/rss/33024

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://isc.sans.edu/diary/rss/33024

What this brief leaves out

This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.

It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.

A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.

Create a free account What it costs