Up a Creek Without a Command Line: Mapping an Akira Ransomware Attack
Huntress, Tuesday, October 6th, 2026
Huntress reconstructs an Akira ransomware attack from registry data and Akira logs after its agent was installed post-compromise.
Huntress researchers investigated an Akira ransomware attack at an organization that deployed the Huntress agent in September, after the attacker already had access.
With limited EDR telemetry from initial access, they rebuilt the timeline from registry data, shellbags and Akira log files, and one EDR signal showed svchost.exe running from C:\PerfLogs\Temp under SYSTEM and loading config.dll on a domain controller.
Even without a recorded ransomware command line, the shellbags, Akira logs and a concurrent PowerShell command deleting volume shadow copies provided strong evidence of execution.