# Akira ransomware kill chain: VPN brute force to domain admin

Published: 2026-05-27 · Severity: high
Canonical: https://vorant.io/reports/1ad81f2a-4d72-515b-9051-d14f451e04f1/akira-ransomware-kill-chain-vpn-brute-force-to-domain-admin

> Akira intrusion via brute-forced local SSLVPN account escalates to domain admin and encryption within 72 hours, visible only in joined firewall and endpoint logs.

This forensic walkthrough reconstructs a complete Akira ransomware intrusion from perimeter firewall and Windows event logs alone, with no EDR or memory analysis. The attack chain begins with credential stuffing against a deprovisioned-in-AD-but-still-active local SSLVPN account with no MFA, succeeding after a single-source brute force. Post-VPN, the attacker pivots to internal discovery via the jump host: nltest, net group queries for Domain Admins, whoami, and AdFind scanning. Within 24 hours, Kerberoasting against three service accounts appears as a tight cluster of RC4-encrypted EID 4769 events—a reliable detection signature. Lateral movement over two days uses RDP (EID 4624 Logon Type 10) to compromise the file server, both domain controllers, and backup servers. The attacker creates a new account in a non-default OU and runs encoded PowerShell reconnaissance against backup infrastructure and shadow-copy state. The final 12 hours involve Security log clearing (EID 1102), endpoint protection service shutdown (System EID 7036), vssadmin shadow-copy deletion, and encryption across all reachable hosts.

The critical insight is temporal distribution: encryption represents only five percent of dwell time; the remaining 95 percent—discovery, lateral movement, privilege escalation, pre-staging—sits entirely in logs most organizations already retain if they join firewall and endpoint sources by normalized timestamp and source IP. Akira's tradecraft is commodity-level; the intrusion succeeds only because perimeter and endpoint logging are treated as separate problems.

## Mentioned in this report

- Threat actors: Akira
- Malware: Akira

## Detection guidance (public sample)

### Shadow Copy Deletion via Vssadmin

ATT&CK: T1490

Detects vssadmin.exe deleting shadow copies, a pre-encryption step to inhibit recovery in Akira and other ransomware intrusions. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Shadow Copy Deletion via Vssadmin
description: Detects vssadmin.exe deleting or resizing shadow copies to inhibit system
  recovery before ransomware encryption. Matches the command-line pattern, not specific
  hosts or accounts.
tags:
- attack.impact
- attack.t1490
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith: \vssadmin.exe
  selection_cli:
    CommandLine|contains|all:
    - delete
    - shadows
  selection_resize:
    CommandLine|contains|all:
    - resize
    - shadowstorage
  condition: selection_img and (selection_cli or selection_resize)
falsepositives:
- Backup or storage administrators intentionally purging shadow copies during maintenance
- Disk cleanup scripts that run vssadmin delete shadows
level: high
id: 6fc9356a-e44f-5b0b-894f-c1e15f799285
status: experimental
author: Vorant
references:
- https://isc.sans.edu/diary/rss/33024
```

### Encoded PowerShell Querying Backup or Shadow Copy State

ATT&CK: T1490

Detects PowerShell with encoded commands launched alongside shadow copy or backup related references, matching the attacker's recon against backup infrastructure. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Encoded PowerShell Querying Backup or Shadow Copy State
description: Detects powershell.exe or pwsh.exe launched with an encoded command while
  the command line references shadow copies or backup components, such as Get-WmiObject
  Win32_ShadowCopy or Veeam. Generalises on the flags plus backup keywords, not on
  a specific payload.
tags:
- attack.impact
- attack.t1490
- attack.discovery
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
    - \powershell.exe
    - \pwsh.exe
  selection_enc:
    CommandLine|contains:
    - ' -enc'
    - ' -EncodedCommand'
    - ' -ec '
  selection_backup:
    CommandLine|contains:
    - Win32_ShadowCopy
    - shadowcopy
    - Veeam
    - wbadmin
  condition: selection_img and selection_enc and selection_backup
falsepositives:
- Backup management software invoking encoded PowerShell to query Veeam or VSS state
- Admin monitoring scripts that wrap shadow copy checks in encoded commands
level: medium
id: f76bb591-18a1-57c5-a050-3c3e8354d9c3
status: experimental
author: Vorant
references:
- https://isc.sans.edu/diary/rss/33024
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://isc.sans.edu/diary/rss/33024

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/1ad81f2a-4d72-515b-9051-d14f451e04f1/akira-ransomware-kill-chain-vpn-brute-force-to-domain-admin.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup