# Akira Ransomware Kill Chain — SSLVPN Credential Stuffing → Kerberoasting → RDP Lateral → vssadmin Shadow Copy Deletion (SANS ISC Forensic Reconstruction, May 2026)

> SANS ISC handler Manuel Humberto Santander Pelaez published a forensic reconstruction (May 27 2026) of an Akira ransomware intrusion at a mid-sized organization using only SSLVPN syslog and Windows EVTX exports (no EDR, PCAP, or memory). The reconstructed 6-stage kill chain — SSLVPN brute force of a deprovisioned local firewall account, AD discovery via nltest/net/whoami/renamed-AdFind, Kerberoasting of three service accounts (RC4 TGS within 90s), RDP-only lateral movement (Logon Type 10) to file server/DCs/backup, EncodedCommand PowerShell backup recon, Security log clearing (EID 1102), endpoint protection termination via sc.exe/net stop, vssadmin shadow copy wipe, then encryption — shows that encryption represents only ~5% of dwell time and that the other 95% was visible in logs already retained but siloed between firewall and Windows event channels. The diary is the most complete fully-from-logs Akira kill chain published in 2026 and provides direct, high-fidelity detection content for every Akira affiliate observed since the family emerged in March 2023.

- **Published:** 2026-05-27T00:00:00Z
- **Last reviewed:** 2026-05-27T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0610
- **ID:** TL-2026-0610
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Akira
- **Detections:** 9 · **IOCs:** 33 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2023-20269, CVE-2024-40766, CVE-2024-20481, CVE-2023-27532, CVE-2024-37085

## Description

## Executive Summary

On 27 May 2026 SANS Internet Storm Center published Diary 33024 — 'Reconstructing an Akira Ransomware Kill Chain from Perimeter and Endpoint Logs' — authored by handler Manuel Humberto Santander Pelaez. The diary is a forensic reconstruction of an Akira ransomware intrusion at a mid-sized organization where the only telemetry retained was SSLVPN/auth/IPS firewall syslog (~7 days) and default-size Windows Security/System/PowerShell-Operational EVTX exports. There was no EDR, no PCAP, no proxy log, and no memory capture. Despite that, the handler reconstructed a complete six-stage kill chain spanning the full Mandiant 'time-to-impact' window. The reconstructed dwell time was roughly 2.5 days; encryption itself accounted for only ~5% of that, and the remaining 95% was directly observable in logs the customer already had — but those logs lived in two unjoined sources (firewall and Windows event channel) and were never correlated until the incident response.

## Stage 1 — Initial Access (SSLVPN Credential Stuffing, ~6 hours)

The intrusion began with sustained SSLVPN authentication failures from a single hosting-provider IP against a single local SSLVPN account. The account in question had been disabled in Active Directory long before the incident but had never been removed from the firewall's local SSLVPN user database — the firewall vendor and the AD did not share a directory of record. The account had no MFA. The brute-force succeeded after roughly six hours of sustained online attempts. The firewall logged thousands of 'auth fail' lines and then a single 'auth success' line from the same source IP for the same username. No Windows authentication log records this stage — it terminated at the firewall.

Article notes that a 'firewall vendor known SSLVPN credential exposure issue' (consistent with the Cisco ASA/FTD CVE-2023-20269 and SonicWall CVE-2024-40766 classes of issue that Akira affiliates have abused operationally since at least August 2023) is plausible but not strictly provable from the available evidence — the deprovisioning gap alone is sufficient to explain the access.

## Stage 2 — Discovery (Active Directory Enumeration)

Within minutes of the successful VPN authentication, EID 4624 Logon Type 10 (RemoteInteractive) records appear on a Windows jump host inside the corporate LAN. EID 4688 process-creation telemetry on the jump host (collected before it rolled out of the default ring buffer) shows a tight process tree under explorer.exe → cmd.exe: nltest.exe /dclist:; net.exe group 'Domain Admins' /domain; net.exe group 'Enterprise Admins' /domain; whoami.exe /all; and a renamed AdFind.exe binary (BinaryName/OriginalFilename mismatch present in the 4688 record). Each command ran with the SSLVPN user's domain token.

## Stage 3 — Credential Access (Kerberoasting, ≤90 seconds)

Approximately ten minutes after discovery, a cluster of EID 4769 Kerberos service-ticket-request events appears on both domain controllers. All requests originated from the jump host, all targeted service-principal-named accounts (three service accounts in total), and all returned TGS tickets encrypted with RC4 (ticket encryption type 0x17). The entire cluster completed in under 90 seconds. This is canonical Rubeus/Invoke-Kerberoast behavior. The harvested tickets were taken offline — the article notes no further on-host artefact for the cracking step — and within hours, plaintext credentials for two of the three service accounts were used inside the environment.

## Stage 4 — Lateral Movement (RDP-only, 2 days)

For the next two days the operator moved laterally almost exclusively over RDP — Logon Type 10 clusters on EID 4624 from the jump host to the file server, both domain controllers, and the backup server. Each domain-controller logon was followed by EID 4672 (special privileges assigned) for the cracked service-account token. No SMB-named-pipe lateral movement, no WMI exec, no PsExec service install — just RDP. The operator favored RDP throughout because (a) the service accounts had interactive logon rights and (b) RDP traffic blends with legitimate admin behavior in this environment.

## Stage 5 — Defense Evasion & Impact Prep

On the backup server the operator launched multiple PowerShell sessions with the -EncodedCommand flag, decoded contents (recovered from PowerShell-Operational EID 4104 script-block logging on the few hosts where it was enabled) showed enumeration of veeam/replication/backup repository state and shadow-copy availability. On the file server the Security event log was cleared (EID 1102, audit log cleared). On every reachable host endpoint protection services were stopped via sc.exe stop and net stop, generating System EID 7036 'service stopped' events for the EDR/AV services. Then vssadmin delete shadows /all /quiet ran on every reachable host (EID 4688 captures it where the buffer hadn't rolled).

## Stage 6 — Impact (Akira Encryption)

Within minutes of the shadow-copy wipe, the Akira encryptor was executed across all reachable hosts. The ransom note (akira_readme.txt) and a sample of encrypted files (.akira extension) were the only artefacts used for family attribution — the kill chain itself is family-agnostic and is shared by Akira, Black Basta, BlackSuit, Royal/Conti-derived affiliates. Encryption finished within a few hours.

## Detection Engineering Takeaways

Three takeaways drive the detection guidance: (1) inventory local SSLVPN accounts and reconcile against the directory of record; the deprovisioned-in-AD-but-not-in-firewall account is the most common Akira initial access pathway in 2025–2026; (2) firewall authentication-failure thresholds — alert on >50 failed SSLVPN authentications from a single source in any one-hour window — would have fired here ~5 hours before the success; (3) JOIN perimeter SSLVPN syslog with Windows EVTX on (normalized source IP, timestamp ±5min) — each stage was high-confidence in one source only, and the join produces the full kill chain.

## Attribution and IOC Enrichment Note

The source article anonymized all identifiers — no IPs, domains, hashes, account names, or domain names are present. Network and file IOCs in this record are sourced from prior public Akira reporting (CISA/FBI/NSA/HHS joint advisory AA24-109A and its September 2024 update, S-RM Cyber Threat Intelligence Briefing, Arctic Wolf Akira tracking, Sophos X-Ops, BushidoToken, and Truesec reporting from 2024–2026) and are tagged as historical Akira tradecraft rather than evidence from this specific engagement.

## MITRE ATT&CK

- T1590 Gather Victim Network Information
- T1583.003 Acquire Infrastructure: Virtual Private Server
- T1588.002 Obtain Capabilities: Tool
- T1078.002 Valid Accounts: Domain Accounts
- T1078.003 Valid Accounts: Local Accounts
- T1133 External Remote Services
- T1110.001 Brute Force: Password Guessing
- T1110.004 Brute Force: Credential Stuffing
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1059.003 Command and Scripting Interpreter: Windows Command Shell
- T1569.002 System Services: Service Execution
- T1136.002 Create Account: Domain Account
- T1098 Account Manipulation
- T1078 Valid Accounts
- T1484.001 Group Policy Modification
- T1685.005 Clear Windows Event Logs
- T1685 Disable or Modify Tools
- T1685.001 Disable or Modify Windows Event Log
- T1036.003 Rename Legitimate Utilities
- T1027.010 Obfuscated Files or Information: Command Obfuscation
- T1558.003 Steal or Forge Kerberos Tickets: Kerberoasting
- T1110.002 Brute Force: Password Cracking
- T1482 Domain Trust Discovery
- T1087.002 Account Discovery: Domain Account
- T1069.002 Permission Groups Discovery: Domain Groups
- T1018 Remote System Discovery
- T1033 System Owner/User Discovery
- T1021.001 Remote Services: Remote Desktop Protocol
- T1550.003 Use Alternate Authentication Material: Pass the Ticket
- T1039 Data from Network Shared Drive
- T1219 Remote Access Tools
- T1572 Protocol Tunneling
- T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage
- T1020 Automated Exfiltration
- T1486 Data Encrypted for Impact
- T1490 Inhibit System Recovery
- T1489 Service Stop
- T1657 Financial Theft

## Sources

- [Reconstructing an Akira Ransomware Kill Chain from Perimeter and Endpoint Logs (SANS ISC Diary 33024)](https://isc.sans.edu/diary/rss/33024)
- [#StopRansomware: Akira Ransomware (CISA/FBI/EC3/NCSC-NL joint advisory AA24-109A, original publish + September 2024 update)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-109a)
- [Cisco Security Advisory cisco-sa-asaftd-ravpn-auth-8LyfCkeC — Cisco ASA and FTD Remote Access VPN Unauthorized Access Vulnerability (CVE-2023-20269)](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-ravpn-auth-8LyfCkeC)
- [SonicWall PSIRT SNWLID-2024-0015 — Improper Access Control in SonicOS SSLVPN (CVE-2024-40766)](https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0015)
- [NVD CVE-2023-27532 — Veeam Backup & Replication Cloud Connect credential exposure](https://nvd.nist.gov/vuln/detail/CVE-2023-27532)
- [Sophos X-Ops — Akira ransomware: an early look at the ransomware family that's targeting Cisco VPNs](https://news.sophos.com/en-us/2023/09/14/akira-ransomware-is-bringin-1988-back/)
- [S-RM Cyber Threat Intelligence — Akira: an emerging ransomware operation](https://www.s-rminform.com/cyber-intelligence-briefing/akira-an-emerging-ransomware-operation)
- [Arctic Wolf Labs — Conti and Akira: Chained Together](https://arcticwolf.com/resources/blog/conti-and-akira-chained-together/)
- [BushidoToken — Tracking Akira ransomware operations and infrastructure](https://blog.bushidotoken.net/2024/01/threat-actor-profile-akira-ransomware.html)
- [Truesec — Akira ransomware investigation: SonicWall SSLVPN exploitation pattern](https://www.truesec.com/hub/blog/akira-ransomware-and-sonicwall-sslvpn)
- [MITRE ATT&CK — T1110.003 Brute Force: Password Spraying / T1078.002 Valid Accounts: Domain Accounts](https://attack.mitre.org/techniques/T1110/003/)
- [MITRE ATT&CK — T1558.003 Steal or Forge Kerberos Tickets: Kerberoasting](https://attack.mitre.org/techniques/T1558/003/)
- [MITRE ATT&CK — T1490 Inhibit System Recovery (vssadmin)](https://attack.mitre.org/techniques/T1490/)
- [MITRE ATT&CK — T1486 Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486/)
- [SANS ISC Internet Storm Center — main feed](https://isc.sans.edu/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0610