Akira Ransomware Kill Chain — SSLVPN Credential Stuffing → Kerberoasting → RDP Lateral → vssadmin Shadow Copy Deletion (SANS ISC Forensic Reconstruction, May 2026)

Akira Ransomware Kill Chain (TL-2026-0610), also tracked as SANS ISC Diary 33024, is a high-severity ransomware operation, first published 2026-05-27. It is attributed to Akira with high confidence, affects Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense, references 5 CVEs (CVE-2023-20269, CVE-2024-40766, CVE-2024-20481), maps to 38 MITRE ATT&CK techniques (T1018, T1020, T1021.001), and is covered by 9 detection rules and 33 indicators of compromise.

Key facts for TL-2026-0610

Threat ID
TL-2026-0610
Also known as
SANS ISC Diary 33024, Akira SSLVPN→Kerberoast→RDP→vssadmin Kill Chain, Akira 2026 Forensic Reconstruction (SANS)
Severity
HIGH
Status
ACTIVE
Category
RANSOMWARE
First published
2026-05-27
Last reviewed
2026-05-27
Attribution
Akira
Attribution confidence
HIGH
Motivation
FINANCIAL
Target sectors
manufacturing, professional-services, education, healthcare, finance, construction, government, legal, real-estate, transportation, technology, retail
Target regions
North America, Europe, United Kingdom, Australia, New Zealand, Latin America
Detection rules
9
Indicators of compromise
33

Malware and tooling in Akira Ransomware Kill Chain

Malware and tooling: Akira, Megazord - S1191, AdFind - S0552, AnyDesk, AnyDesk + Rclone-to-MEGA + Tor, PCHunter, Rclone - S1040, Rubeus - S1071, WinSCP

SANS ISC handler Manuel Humberto Santander Pelaez published a forensic reconstruction (May 27 2026) of an Akira ransomware intrusion at a mid-sized organization using only SSLVPN syslog and Windows EVTX exports (no EDR, PCAP, or memory). The reconstructed 6-stage kill chain — SSLVPN brute force of a deprovisioned local firewall account, AD discovery via nltest/net/whoami/renamed-AdFind, Kerberoasting of three service accounts (RC4 TGS within 90s), RDP-only lateral movement (Logon Type 10) to file server/DCs/backup, EncodedCommand PowerShell backup recon, Security log clearing (EID 1102), endpoint protection termination via sc.exe/net stop, vssadmin shadow copy wipe, then encryption — shows that encryption represents only ~5% of dwell time and that the other 95% was visible in logs already retained but siloed between firewall and Windows event channels. The diary is the most complete fully-from-logs Akira kill chain published in 2026 and provides direct, high-fidelity detection content for every Akira affiliate observed since the family emerged in March 2023.

How Akira Ransomware Kill Chain works

## Executive Summary

On 27 May 2026 SANS Internet Storm Center published Diary 33024 — 'Reconstructing an Akira Ransomware Kill Chain from Perimeter and Endpoint Logs' — authored by handler Manuel Humberto Santander Pelaez. The diary is a forensic reconstruction of an Akira ransomware intrusion at a mid-sized organization where the only telemetry retained was SSLVPN/auth/IPS firewall syslog (~7 days) and default-size Windows Security/System/PowerShell-Operational EVTX exports. There was no EDR, no PCAP, no proxy log, and no memory capture. Despite that, the handler reconstructed a complete six-stage kill chain spanning the full Mandiant 'time-to-impact' window. The reconstructed dwell time was roughly 2.5 days; encryption itself accounted for only ~5% of that, and the remaining 95% was directly observable in logs the customer already had — but those logs lived in two unjoined sources (firewall and Windows event channel) and were never correlated until the incident response.

## Stage 1 — Initial Access (SSLVPN Credential Stuffing, ~6 hours)

The intrusion began with sustained SSLVPN authentication failures from a single hosting-provider IP against a single local SSLVPN account. The account in question had been disabled in Active Directory long before the incident but had never been removed from the firewall's local SSLVPN user database — the firewall vendor and the AD did not share a directory of record. The account had no MFA. The brute-force succeeded after roughly six hours of sustained online attempts. The firewall logged thousands of 'auth fail' lines and then a single 'auth success' line from the same source IP for the same username. No Windows authentication log records this stage — it terminated at the firewall.

Article notes that a 'firewall vendor known SSLVPN credential exposure issue' (consistent with the Cisco ASA/FTD CVE-2023-20269 and SonicWall CVE-2024-40766 classes of issue that Akira affiliates have abused operationally since at least August 2023) is plausible but not strictly provable from the available evidence — the deprovisioning gap alone is sufficient to explain the access.

## Stage 2 — Discovery (Active Directory Enumeration)

Within minutes of the successful VPN authentication, EID 4624 Logon Type 10 (RemoteInteractive) records appear on a Windows jump host inside the corporate LAN. EID 4688 process-creation telemetry on the jump host (collected before it rolled out of the default ring buffer) shows a tight process tree under explorer.exe → cmd.exe: nltest.exe /dclist:; net.exe group 'Domain Admins' /domain; net.exe group 'Enterprise Admins' /domain; whoami.exe /all; and a renamed AdFind.exe binary (BinaryName/OriginalFilename mismatch present in the 4688 record). Each command ran with the SSLVPN user's domain token.

## Stage 3 — Credential Access (Kerberoasting, ≤90 seconds)

Approximately ten minutes after discovery, a cluster of EID 4769 Kerberos service-ticket-request events appears on both domain controllers. All requests originated from the jump host, all targeted service-principal-named accounts (three service accounts in total), and all returned TGS tickets encrypted with RC4 (ticket encryption type 0x17). The entire cluster completed in under 90 seconds. This is canonical Rubeus/Invoke-Kerberoast behavior. The harvested tickets were taken offline — the article notes no further on-host artefact for the cracking step — and within hours, plaintext credentials for two of the three service accounts were used inside the environment.

## Stage 4 — Lateral Movement (RDP-only, 2 days)

For the next two days the operator moved laterally almost exclusively over RDP — Logon Type 10 clusters on EID 4624 from the jump host to the file server, both domain controllers, and the backup server. Each domain-controller logon was followed by EID 4672 (special privileges assigned) for the cracked service-account token. No SMB-named-pipe lateral movement, no WMI exec, no PsExec service install — just RDP. The operator favored RDP throughout because (a) the service accounts had interactive logon rights and (b) RDP traffic blends with legitimate admin behavior in this environment.

## Stage 5 — Defense Evasion & Impact Prep

On the backup server the operator launched multiple PowerShell sessions with the -EncodedCommand flag, decoded contents (recovered from PowerShell-Operational EID 4104 script-block logging on the few hosts where it was enabled) showed enumeration of veeam/replication/backup repository state and shadow-copy availability. On the file server the Security event log was cleared (EID 1102, audit log cleared). On every reachable host endpoint protection services were stopped via sc.exe stop and net stop, generating System EID 7036 'service stopped' events for the EDR/AV services. Then vssadmin delete shadows /all /quiet ran on every reachable host (EID 4688 captures it where the buffer hadn't rolled).

## Stage 6 — Impact (Akira Encryption)

Within minutes of the shadow-copy wipe, the Akira encryptor was executed across all reachable hosts. The ransom note (akira_readme.txt) and a sample of encrypted files (.akira extension) were the only artefacts used for family attribution — the kill chain itself is family-agnostic and is shared by Akira, Black Basta, BlackSuit, Royal/Conti-derived affiliates. Encryption finished within a few hours.

## Detection Engineering Takeaways

Three takeaways drive the detection guidance: (1) inventory local SSLVPN accounts and reconcile against the directory of record; the deprovisioned-in-AD-but-not-in-firewall account is the most common Akira initial access pathway in 2025–2026; (2) firewall authentication-failure thresholds — alert on >50 failed SSLVPN authentications from a single source in any one-hour window — would have fired here ~5 hours before the success; (3) JOIN perimeter SSLVPN syslog with Windows EVTX on (normalized source IP, timestamp ±5min) — each stage was high-confidence in one source only, and the join produces the full kill chain.

## Attribution and IOC Enrichment Note

The source article anonymized all identifiers — no IPs, domains, hashes, account names, or domain names are present. Network and file IOCs in this record are sourced from prior public Akira reporting (CISA/FBI/NSA/HHS joint advisory AA24-109A and its September 2024 update, S-RM Cyber Threat Intelligence Briefing, Arctic Wolf Akira tracking, Sophos X-Ops, BushidoToken, and Truesec reporting from 2024–2026) and are tagged as historical Akira tradecraft rather than evidence from this specific engagement.

MITRE ATT&CK techniques used in TL-2026-0610

Discovery

T1018 Remote System Discovery; T1033 System Owner/User Discovery; T1069.002 Permission Groups Discovery: Domain Groups; T1087.002 Account Discovery: Domain Account; T1482 Domain Trust Discovery

Exfiltration

T1020 Automated Exfiltration; T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage

Lateral Movement

T1021.001 Remote Services: Remote Desktop Protocol; T1550.003 Use Alternate Authentication Material: Pass the Ticket

Defense Evasion

T1027.010 Obfuscated Files or Information: Command Obfuscation; T1036.003 Rename Legitimate Utilities

Collection

T1039 Data from Network Shared Drive

Execution

T1059.001 Command and Scripting Interpreter: PowerShell; T1059.003 Command and Scripting Interpreter: Windows Command Shell; T1569.002 System Services: Service Execution

Persistence

T1078 Valid Accounts; T1098 Account Manipulation; T1136.002 Create Account: Domain Account

Initial Access

T1078.002 Valid Accounts: Domain Accounts; T1078.003 Valid Accounts: Local Accounts; T1133 External Remote Services

credential-access

T1110.001 Brute Force: Password Guessing; T1110.004 Brute Force: Credential Stuffing

Credential Access

T1110.002 Brute Force: Password Cracking; T1558.003 Steal or Forge Kerberos Tickets: Kerberoasting

Command and Control

T1219 Remote Access Tools; T1572 Protocol Tunneling

Privilege Escalation

T1484.001 Group Policy Modification

Impact

T1486 Data Encrypted for Impact; T1489 Service Stop; T1490 Inhibit System Recovery; T1657 Financial Theft

Resource Development

T1583.003 Acquire Infrastructure: Virtual Private Server; T1588.002 Obtain Capabilities: Tool

Reconnaissance

T1590 Gather Victim Network Information

defense-impairment

T1685 Disable or Modify Tools; T1685.001 Disable or Modify Windows Event Log; T1685.005 Clear Windows Event Logs

Affected products and versions in Akira Ransomware Kill Chain

  • Cisco — Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) SSLVPN
    Vulnerable versions: ASA < 9.16.4.55; ASA < 9.18.4; ASA < 9.19.1.12; FTD with affected ASA engine
    Fixed in: ASA 9.16.4.55+; ASA 9.18.4+; ASA 9.19.1.12+
  • SonicWall — SonicOS SSLVPN
    Vulnerable versions: SonicOS 7.0.1-5035 and earlier; SonicOS 6.5.4.15-116n and earlier
    Fixed in: SonicOS 7.0.1-5035; SonicOS 6.5.4.15-117n
  • Microsoft — Windows Server (Active Directory, RDP, Kerberos)
    Vulnerable versions: Server 2016; Server 2019; Server 2022; Server 2025
    Fixed in: Hardened AES-only Kerberos + restricted RDP + EID 4104 logging
  • Microsoft — Windows Endpoint (RDP target / domain-joined workstation)
    Vulnerable versions: Windows 10; Windows 11
    Fixed in: Hardened with EDR + AppLocker + restricted RDP
  • Veeam — Backup & Replication
    Vulnerable versions: < 12.1 (with CVE-2023-27532 unpatched)
    Fixed in: 12.1+

Remediation for Akira Ransomware Kill Chain

Patches

  • Cisco ASA/FTD CVE-2023-20269 — upgrade to 9.16.4.55, 9.18.4, 9.19.1.12 or later (Cisco advisory cisco-sa-asaftd-ravpn-auth-8LyfCkeC, September 2023)
  • SonicWall SonicOS CVE-2024-40766 — upgrade to SonicOS 7.0.1-5035 or 6.5.4.15-117n (SonicWall SNWLID-2024-0015, August 2024)
  • Cisco ASA/FTD CVE-2024-20481 — DoS via RAVPN brute force; rate-limit AnyConnect logon attempts (October 2024)

Immediate actions

  • Inventory every local SSLVPN account on every perimeter firewall; reconcile each against the Active Directory user list of record; disable any account that is disabled or deprovisioned in AD
  • Enforce MFA on every SSLVPN authentication path (SAML/RADIUS-with-Duo/MS-Authenticator) — local-only-firewall-database SSLVPN accounts are the single most common Akira initial access vector in 2025–2026
  • Block all known Akira affiliate VPN brute-force source ranges at the perimeter (see iocs[] for CISA AA24-109A network IOCs)
  • Apply Cisco ASA/FTD 9.16.4.55+ / 9.18.4+ / 9.19.1.12+ to remediate CVE-2023-20269 (default-credential SSLVPN brute force vector); apply SonicWall SonicOS 7.0.1-5035+/6.5.4.15-117n+ to remediate CVE-2024-40766 (SonicWall SSLVPN access control)
  • Set Kerberos service accounts to use AES-256 only (msDS-SupportedEncryptionTypes = 0x18); rotate every SPN-bound service account credential to a 25+ character random secret; disable RC4 across the forest where possible
  • Restrict RDP across the LAN to a hardened jump-host model; deny RDP from workstation subnets to servers; enforce Network Level Authentication; require MFA at the RDP gateway

Workarounds

  • If you cannot patch the perimeter device immediately, disable local-database SSLVPN authentication and force all SSLVPN auth through an external IdP (SAML/RADIUS) with MFA
  • Block inbound RDP from the SSLVPN address pool at the firewall — VPN-tunnel users should never need direct RDP to DCs/file servers/backup servers
  • Implement vssadmin and wmic shadowcopy blocking via WDAC or AppLocker — most enterprises do not legitimately invoke vssadmin delete shadows /all /quiet

Longer-term hardening

  • Deploy EDR with behavioral detection on every server and admin workstation — EID 4688 alone is insufficient for Kerberoasting/encoded-PowerShell/vssadmin detection at scale
  • Enable PowerShell Script Block Logging (EID 4104) and Module Logging on every Windows host via GPO — this engagement was reconstructable only because a subset of hosts had 4104 enabled
  • Increase Windows Security event log size to ≥1 GB on jump hosts, file servers, DCs and backup servers; 4688/4624/4769 high-volume events roll off default-size logs in hours
  • Forward firewall SSLVPN/auth/IPS syslog AND Windows Security/System/PowerShell-Operational EVTX into a single SIEM with retention ≥90 days; pre-build the join on (normalized source IP, timestamp) so kill-chain reconstruction can be done in minutes not days
  • Isolate backup infrastructure (Veeam, network shares for backup repos) into a separate AD forest or workgroup; require step-up MFA for backup console access; enable immutable/object-lock backup storage so vssadmin and Veeam-repo deletion cannot destroy recovery

CVEs associated with Akira Ransomware Kill Chain

CVE-2023-20269, CVE-2024-40766, CVE-2024-20481, CVE-2023-27532, CVE-2024-37085

Weaknesses (CWE) in Akira Ransomware Kill Chain

CWE-307, CWE-287, CWE-294, CWE-862, CWE-693

Timeline of Akira Ransomware Kill Chain

  • Akira ransomware first observed in the wild — early variants written in C++, Windows-only encryptor, ChaCha20+RSA, Tor leaks site akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion goes live
  • Akira Linux/ESXi encryptor variant identified in the wild (Sophos X-Ops, Avast) — VMware ESXi targeting accelerates Akira's growth in mid-sized enterprises
  • Arctic Wolf Labs publishes 'Conti and Akira: Chained Together' linking Akira affiliates to former Conti operators via TTP and cryptocurrency flow analysis
  • Cisco publishes advisory cisco-sa-asaftd-ravpn-auth-8LyfCkeC for CVE-2023-20269 (ASA/FTD SSLVPN unauthorized access via brute force against accounts without MFA); Akira affiliates are the primary observed abusers
  • CISA, FBI, Europol EC3 and NCSC-NL publish joint advisory #StopRansomware: Akira Ransomware (AA24-109A) — 250+ confirmed victims, $42M+ in ransom payments
  • SonicWall publishes SNWLID-2024-0015 for CVE-2024-40766 (SonicOS SSLVPN improper access control); Truesec and Arctic Wolf attribute observed exploitation to Akira affiliates
  • CISA updates AA24-109A with new IOCs and TTPs; documents Akira's pivot to Cisco AnyConnect and SonicWall SSLVPN exploitation as dominant 2024 initial-access vector
  • Akira v2 (Megazord — Rust rewrite) seen at high volume; CISA-tracked victim count crosses 600; SSLVPN+Kerberoasting kill chain remains canonical
  • SANS ISC handler engaged for IR support at mid-sized organization — SSLVPN syslog + Windows EVTX exports are only telemetry retained, no EDR/PCAP
  • SANS ISC publishes Diary 33024 'Reconstructing an Akira Ransomware Kill Chain from Perimeter and Endpoint Logs' (Manuel Humberto Santander Pelaez) — full 6-stage kill chain reconstructed from perimeter + Windows event logs alone
  • As of 2026-05-29, Akira remains a top-tier active RaaS — 84 victims in March 2026, 1,400+ total, $245M+ collected, with CISA's AA24-109A updated Nov 2025 calling it an imminent critical-infra threat. The SSLVPN-brute (CVE-2024-40766) to Kerberoast to RDP to vssadmin kill chain in this SANS ISC diary is canonical and still actively exploited.

Sources cited for Akira Ransomware Kill Chain

Threats related to Akira Ransomware Kill Chain

Detection coverage for TL-2026-0610

As of 2026-05-27, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0610 across Splunk SPL, Microsoft KQL and Sigma, covering 33 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Further reading

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats