Huntress Analyzes Akira Ransomware Attack After EDR Failure

• •Huntress reconstructed an Akira ransomware attack without EDR telemetry.
• •The attack involved RDP access from an external workstation and the use of GOST for tunneling.
• •Volume shadow copies were deleted to prevent recovery, a common tactic used by Akira.

In September 2026, Huntress deployed its agent at an organization already compromised by Akira ransomware. The post-compromise installation meant crucial EDR telemetry was missing, hindering initial access insights. Researchers reconstructed the attack using Windows Event Logs, Registry artifacts, and Akira log files. The attack began with the execution of svchost.exe from a suspicious directory, followed by unauthorized access via RDP from an external workstation. The attacker accessed the BitDefender console and executed commands to delete volume shadow copies, a typical Akira tactic. The analysis revealed the use of GOST, an open-source tunneling tool, and Rclone for data exfiltration. The ransomware subsequently encrypted the organization's file shares. Huntress emphasized the importance of maintaining accurate system inventories and reducing attack surfaces.