{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "promote-to-detection", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "Akira ransomware causes total availability loss; detecting the GOST tunnel and RClone exfiltration provides a critical window to prevent encryption." }, "name": "Akira Ransomware: GOST Tunneling and Data Impact", "type": "investigation", "labels": [ "hunt", "attack.t1572", "attack.t1041", "attack.t1567.002", "attack.t1490", "attack.t1047", "attack.t1059.001", "attack.t1486", "command and control", "credential access", "defense evasion", "exfiltration", "impact", "lateral movement" ], "series": { "slug": "up-a-creek-without-a-command-line-mapping-an-akira-ransomware-attack", "index": 2, "title": "Up a Creek Without a Command Line: Mapping an Akira Ransomware Attack", "total": 2 }, "related": [ { "hunt": "akira-initial-access-rdp", "reason": "Initial access via RDP is handled by a separate authentication-focused hunt.", "relation": "out-of-scope-alternative" }, { "hunt": "akira-remote-access-security-disruption", "relation": "follows" } ], "targets": { "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "network": { "name": "Network telemetry", "category": "network", "telemetry": [ "network" ] }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] } }, "analysis": "A single rule on shadow copy deletion may have false positives from backup software; this hunt pivots to look for persistence (GOST) and data staging (RClone) to confirm malicious intent.", "coverage": [ { "stage": "gost-tunneling-persistence", "steps": [ "perflogs-host-discovery", "gost-network-activity" ], "status": "covered" }, { "stage": "rclone-data-exfiltration", "steps": [ "rclone-prevalence" ], "status": "covered" }, { "stage": "inhibit-recovery-shadow-copy-deletion", "steps": [ "shadow-copy-deletion" ], "status": "covered" }, { "stage": "akira-data-encryption", "steps": [ "akira-artifacts" ], "status": "covered" }, { "stage": "rdp-lateral-access", "reason": "Belongs to another part of the 'Up a Creek Without a Command Line: Mapping an Akira Ransomware Attack' series.", "status": "out_of_scope" }, { "stage": "defense-evasion-service-stop", "reason": "Belongs to another part of the 'Up a Creek Without a Command Line: Mapping an Akira Ransomware Attack' series.", "status": "out_of_scope" }, { "stage": "lsass-credential-dumping", "reason": "Belongs to another part of the 'Up a Creek Without a Command Line: Mapping an Akira Ransomware Attack' series.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "RDP Lateral Access", "slug": "rdp-lateral-access", "tactic": "lateral-movement", "techniques": [ "T1021.001" ], "observables": [ "Workstation name C1IFRYXI", "RDP connection from non-customer workstation" ] }, { "name": "Bitdefender Service Disablement", "slug": "defense-evasion-service-stop", "tactic": "defense-evasion", "observables": [ "Bitdefender Endpoint Update Service stopped", "Bitdefender Endpoint Integration Service stopped", "Bitdefender Endpoint Protected Service stopped", "Bitdefender Endpoint Security Service stopped" ] }, { "name": "LSASS Credential Dumping", "slug": "lsass-credential-dumping", "tactic": "credential-access", "techniques": [ "T1003.001" ], "observables": [ "procdump.exe", "C:\\PerfLogs\\procdump.exe", "lsass.exe dump" ] }, { "name": "GOST Tunneling Persistence", "slug": "gost-tunneling-persistence", "tactic": "command-and-control", "techniques": [ "T1572", "T1041" ], "observables": [ "C:\\PerfLogs\\Temp\\svchost.exe", "C:\\PerfLogs\\Temp\\config.dll", "d00833318a04caa019c6f95dcb3598ad947d405010bfb2f3cbd04530a00bc3a4", "64.227.4.134" ] }, { "name": "RClone Data Exfiltration", "slug": "rclone-data-exfiltration", "tactic": "exfiltration", "techniques": [ "T1567.002" ], "observables": [ "rclone.exe", "C:\\PerfLogs\\rclone.exe" ] }, { "name": "Recovery Inhibition via Shadow Copy Deletion", "slug": "inhibit-recovery-shadow-copy-deletion", "tactic": "impact", "techniques": [ "T1490", "T1047", "T1059.001" ], "observables": [ "powershell.exe -Command Get-WmiObject Win32_Shadowcopy | Remove-WmiObject" ] }, { "name": "Akira Data Encryption", "slug": "akira-data-encryption", "tactic": "impact", "techniques": [ "T1486" ], "observables": [ "win.exe", "1f1bb322591b6d27fd2946e373d7d2efc2f4e1e66818846060d391600b600fba", "Akira log files", "Shellbags access to Shares folder" ] } ], "summary": "Akira ransomware affiliates gained access via RDP and disabled Bitdefender security services before using Procdump to harvest credentials. The attackers established persistence using the GOST tunnel tool and exfiltrated data via RClone before executing the Akira ransomware, which deleted volume shadow copies and encrypted files." }, "severity": "high", "rationale": "The hunt should target domain controllers, file servers, and any hosts with access to internal network shares.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An adversary has established a beachhead by deploying a GOST tunneling tool for persistence and is using RClone for exfiltration, followed by shadow copy deletion and Akira ransomware encryption.", "parameters": { "c2_ips": { "from": { "ref": "huntress-akira-2026", "kind": "article", "observed": "2026-10-06" }, "type": "list[ip]", "default": [ "64.227.4.134" ], "description": "GOST tunnel C2 IP address." }, "scope_hosts": { "from": { "ref": "analyst-scoping", "kind": "manual", "observed": "2024-01-01" }, "type": "list[host]", "default": [], "description": "Specific hosts to investigate; leave empty to scan the entire estate." }, "akira_hashes": { "from": { "ref": "huntress-akira-2026", "kind": "article", "observed": "2026-10-06" }, "type": "list[hash]", "default": [ "1f1bb322591b6d27fd2946e373d7d2efc2f4e1e66818846060d391600b600fba", "d00833318a04caa019c6f95dcb3598ad947d405010bfb2f3cbd04530a00bc3a4" ], "description": "Known Akira ransomware and tunnel tool hashes from the report." }, "lookback_days": { "from": { "ref": "hunt-standard-config", "kind": "manual", "observed": "2024-01-01" }, "type": "number", "default": "14", "description": "Days of history to examine." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://www.huntress.com/blog/mapping-akira-ransomware-attack", "gates": [ "dry-run", "lint" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://www.huntress.com/blog/mapping-akira-ransomware-attack", "name": "Huntress \u2014 Mapping an Akira Ransomware Attack" } ], "blind_spots": [ { "id": "script-block-logging-disabled", "risk": "If logging is disabled, the script-based recovery inhibition remains invisible.", "stage": "inhibit-recovery-shadow-copy-deletion", "question": "whether shadow copies were deleted via PowerShell", "requires": "PowerShell Script Block Logging (Event ID 4104)" }, { "id": "egress-filtering-blindness", "risk": "A tunnel using an unreported IP or chained proxy would be missed by the network query.", "stage": "gost-tunneling-persistence", "question": "whether the tunnel connected to a different IP or via a proxy", "requires": "hb_network_connection with dst_endpoint_ip" } ] }, "name": "Akira Ransomware: GOST Tunneling and Data Impact", "description": "This hunt follows the Akira ransomware attack chain as observed by researchers, focusing on the post-compromise stages of persistence and impact. It identifies the deployment of the GOST (Go Simple Tunnel) utility, often disguised as a system process in the PerfLogs directory, and the subsequent execution of RClone for data exfiltration. The hunt then moves to the impact phase, looking for the characteristic PowerShell/WMI commands used to inhibit system recovery by deleting volume shadow copies, and finally identifies Akira ransomware artifacts including specific file hashes and log markers. By using a phased approach, the hunt allows an analyst to see the progression from a persistent tunnel to active data destruction." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "up-a-creek-without-a-command-line-mapping-an-akira-ransomware-attack", "index": 2, "title": "Up a Creek Without a Command Line: Mapping an Akira Ransomware Attack", "total": 2 }, "coverage": [ { "stage": "gost-tunneling-persistence", "steps": [ "perflogs-host-discovery", "gost-network-activity" ], "status": "covered" }, { "stage": "rclone-data-exfiltration", "steps": [ "rclone-prevalence" ], "status": "covered" }, { "stage": "inhibit-recovery-shadow-copy-deletion", "steps": [ "shadow-copy-deletion" ], "status": "covered" }, { "stage": "akira-data-encryption", "steps": [ "akira-artifacts" ], "status": "covered" }, { "stage": "rdp-lateral-access", "reason": "Belongs to another part of the 'Up a Creek Without a Command Line: Mapping an Akira Ransomware Attack' series.", "status": "out_of_scope" }, { "stage": "defense-evasion-service-stop", "reason": "Belongs to another part of the 'Up a Creek Without a Command Line: Mapping an Akira Ransomware Attack' series.", "status": "out_of_scope" }, { "stage": "lsass-credential-dumping", "reason": "Belongs to another part of the 'Up a Creek Without a Command Line: Mapping an Akira Ransomware Attack' series.", "status": "out_of_scope" } ], "rationale": "An adversary has established a beachhead by deploying a GOST tunneling tool for persistence and is using RClone for exfiltration, followed by shadow copy deletion and Akira ransomware encryption.", "blind_spots": [ { "id": "script-block-logging-disabled", "risk": "If logging is disabled, the script-based recovery inhibition remains invisible.", "stage": "inhibit-recovery-shadow-copy-deletion", "question": "whether shadow copies were deleted via PowerShell", "requires": "PowerShell Script Block Logging (Event ID 4104)" }, { "id": "egress-filtering-blindness", "risk": "A tunnel using an unreported IP or chained proxy would be missed by the network query.", "stage": "gost-tunneling-persistence", "question": "whether the tunnel connected to a different IP or via a proxy", "requires": "hb_network_connection with dst_endpoint_ip" } ], "scoping_notes": "The hunt should target domain controllers, file servers, and any hosts with access to internal network shares.", "beyond_detection": "A single rule on shadow copy deletion may have false positives from backup software; this hunt pivots to look for persistence (GOST) and data staging (RClone) to confirm malicious intent." } }, { "id": "perflogs-host-discovery", "type": "query", "label": "Discovery of activity in PerfLogs", "config": { "dsl": "sqlite", "role": "scoping", "source": "endpoint", "content": "SELECT DISTINCT device_hostname FROM hb_file_activity WHERE (LOWER(file_path) LIKE 'c:\\perflogs\\%' OR instr(',' || '{{akira_hashes}}' || ',', ',' || LOWER(file_hash_sha256) || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_file_activity", "description": "Identify hosts where the C:\\PerfLogs directory has been touched, which is the primary staging area for Akira tools.", "expected_signal": "A list of hostnames. Any result in C:\\PerfLogs or matching report hashes is suspicious." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Discovery of activity in PerfLogs", "reads": [ "device_hostname", "file_hash_sha256", "file_path", "time" ], "source": "hb_file_activity", "target": "endpoint", "content": "SELECT DISTINCT device_hostname FROM hb_file_activity WHERE (LOWER(file_path) LIKE 'c:\\perflogs\\%' OR instr(',' || '{{akira_hashes}}' || ',', ',' || LOWER(file_hash_sha256) || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "A list of hostnames. Any result in C:\\PerfLogs or matching report hashes is suspicious.", "verified": "dry-run", "verified_at": "2026-10-08" } }, { "id": "gost-network-activity", "type": "query", "label": "GOST tunnel network activity", "config": { "dsl": "sqlite", "role": "enrichment", "source": "network", "content": "SELECT device_hostname, process_name, process_path, dst_endpoint_ip, dst_endpoint_port, time FROM hb_network_connection WHERE (instr(',' || '{{c2_ips}}' || ',', ',' || dst_endpoint_ip || ',') > 0 OR (LOWER(process_path) LIKE 'c:\\perflogs\\%' AND dst_endpoint_port > 1024)) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_network_connection", "description": "Find network connections to known C2 IPs or behavioral indicators like high-port egress from the PerfLogs directory.", "expected_signal": "Outbound connections from processes in C:\\PerfLogs to either reported IPs or high ports, confirming the proxy tunnel." }, "parents": [ { "id": "perflogs-host-discovery" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "GOST tunnel network activity", "reads": [ "device_hostname", "dst_endpoint_ip", "dst_endpoint_port", "process_name", "process_path", "time" ], "source": "hb_network_connection", "target": "network", "content": "SELECT device_hostname, process_name, process_path, dst_endpoint_ip, dst_endpoint_port, time FROM hb_network_connection WHERE (instr(',' || '{{c2_ips}}' || ',', ',' || dst_endpoint_ip || ',') > 0 OR (LOWER(process_path) LIKE 'c:\\perflogs\\%' AND dst_endpoint_port > 1024)) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Outbound connections from processes in C:\\PerfLogs to either reported IPs or high ports, confirming the proxy tunnel.", "verified": "dry-run", "verified_at": "2026-10-08" } }, { "id": "rclone-prevalence", "type": "query", "label": "Prevalence of RClone across the fleet", "config": { "dsl": "sqlite", "role": "baseline", "source": "endpoint", "content": "SELECT LOWER(process_name) AS proc, COUNT(DISTINCT device_hostname) AS hosts, MIN(time) AS first_seen FROM hb_process_activity WHERE (LOWER(process_name) LIKE '%rclone%' OR LOWER(process_cmd_line) LIKE '%rclone%') AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY LOWER(process_name) HAVING hosts <= 3", "surface": "hb_process_activity", "description": "Identify hosts where RClone is executing and determine if it is a rare occurrence in the environment.", "expected_signal": "A stack-count showing RClone is only on a few hosts. If it is not a standard IT tool, any hit is suspicious." }, "parents": [ { "id": "perflogs-host-discovery" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Prevalence of RClone across the fleet", "reads": [ "device_hostname", "process_cmd_line", "process_name", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT LOWER(process_name) AS proc, COUNT(DISTINCT device_hostname) AS hosts, MIN(time) AS first_seen FROM hb_process_activity WHERE (LOWER(process_name) LIKE '%rclone%' OR LOWER(process_cmd_line) LIKE '%rclone%') AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY LOWER(process_name) HAVING hosts <= 3", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "A stack-count showing RClone is only on a few hosts. If it is not a standard IT tool, any hit is suspicious.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "process_name" ], "rare_below": 3 }, "verified_at": "2026-10-08" } }, { "id": "early-stage-triage", "type": "analytic", "label": "Early stage persistence triage", "config": { "cite": "required", "tools": [ "endpoint", "network" ], "context": [ "perflogs-host-discovery", "gost-network-activity", "rclone-prevalence" ], "objective": "Confirm whether the adversary established a tunnel and staged data via RClone.", "description": "Evaluate whether the GOST and RClone signals together indicate a confirmed adversary beachhead.", "max_iterations": 3, "expected_signal": "A verdict on the early stages of the Akira chain.", "success_criteria": "A per-host verdict of malicious | suspicious | benign, citing process paths and network peers." }, "parents": [ { "id": "gost-network-activity", "kind": "merge" }, { "id": "rclone-prevalence", "kind": "merge" } ] }, { "id": "shadow-copy-deletion", "type": "query", "label": "Recovery inhibition via shadow copy deletion", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT device_hostname, script_content, actor_user_name, time FROM hb_script_activity WHERE (LOWER(script_content) LIKE '%win32_shadowcopy%' AND LOWER(script_content) LIKE '%remove-wmiobject%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_script_activity", "description": "Identify the specific PowerShell commands used by Akira to delete volume shadow copies.", "expected_signal": "Script blocks matching the shadow copy removal pattern. This is a high-fidelity indicator of ransomware impact." }, "parents": [ { "id": "early-stage-triage" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "Recovery inhibition via shadow copy deletion", "reads": [ "actor_user_name", "device_hostname", "script_content", "time" ], "source": "hb_script_activity", "target": "endpoint", "content": "SELECT device_hostname, script_content, actor_user_name, time FROM hb_script_activity WHERE (LOWER(script_content) LIKE '%win32_shadowcopy%' AND LOWER(script_content) LIKE '%remove-wmiobject%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Script blocks matching the shadow copy removal pattern. This is a high-fidelity indicator of ransomware impact.", "verified": "dry-run", "verified_at": "2026-10-08" } }, { "id": "akira-artifacts", "type": "query", "label": "Akira file artifacts and logs", "config": { "dsl": "sqlite", "role": "triage", "source": "endpoint", "content": "SELECT device_hostname, file_name, file_path, file_hash_sha256, time FROM hb_file_activity WHERE (activity_id IN (1, 3)) AND (LOWER(file_name) LIKE 'akira_log%' OR (LOWER(file_name) = 'win.exe' AND (LOWER(file_path) LIKE 'c:\\perflogs\\%' OR LOWER(file_path) LIKE 'c:\\users\\public\\%')) OR instr(',' || '{{akira_hashes}}' || ',', ',' || LOWER(file_hash_sha256) || ',') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_file_activity", "description": "Locate the ransomware binary and the specific Akira log files created during encryption, focusing on suspect paths.", "expected_signal": "Ransomware arrival evidence (activity_id 1/3) matching win.exe in suspect paths or Akira log files." }, "parents": [ { "id": "early-stage-triage" } ], "primitive_config": { "dsl": "sqlite", "role": "triage", "label": "Akira file artifacts and logs", "reads": [ "activity_id", "device_hostname", "file_hash_sha256", "file_name", "file_path", "time" ], "source": "hb_file_activity", "target": "endpoint", "content": "SELECT device_hostname, file_name, file_path, file_hash_sha256, time FROM hb_file_activity WHERE (activity_id IN (1, 3)) AND (LOWER(file_name) LIKE 'akira_log%' OR (LOWER(file_name) = 'win.exe' AND (LOWER(file_path) LIKE 'c:\\perflogs\\%' OR LOWER(file_path) LIKE 'c:\\users\\public\\%')) OR instr(',' || '{{akira_hashes}}' || ',', ',' || LOWER(file_hash_sha256) || ',') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Ransomware arrival evidence (activity_id 1/3) matching win.exe in suspect paths or Akira log files.", "verified": "dry-run", "verified_at": "2026-10-08" } }, { "id": "full-chain-triage", "type": "analytic", "label": "Full scenario impact triage", "config": { "cite": "required", "tools": [ "endpoint", "network" ], "context": [ "early-stage-triage", "shadow-copy-deletion", "akira-artifacts" ], "objective": "Determine if a host shows the complete progression from GOST persistence to shadow copy deletion and ransomware execution.", "description": "Evaluate the complete chain from persistence to impact per host.", "max_iterations": 6, "expected_signal": "A comprehensive verdict across the entire attack chain.", "success_criteria": "A final verdict citing specific hosts where the full Akira ransomware impact is confirmed." }, "parents": [ { "id": "shadow-copy-deletion", "kind": "merge" }, { "id": "akira-artifacts", "kind": "merge" } ] }, { "id": "route-on-impact", "type": "checkpoint", "label": "Route on full scenario verdict", "config": { "fuzzy": true, "judge": "hunter", "question": "the full-chain-triage verdict is malicious for at least one host", "condition": "the full-chain-triage verdict is malicious for at least one host", "blind_spot": "script-block-logging-disabled", "confidence": "high", "description": "Decide whether to isolate the host based on the confirmed presence of Akira ransomware activity.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "full-chain-triage" } ] }, { "id": "isolate-host", "type": "action", "label": "Isolate affected host", "config": { "target": "endpoint", "description": "Contain the threat before encryption spreads or data is fully exfiltrated.", "instructions": "Isolate the host immediately. Revoke any credentials that logged into this host within the lookback window.", "action_approval": "required" }, "parents": [ { "id": "route-on-impact", "branch": "on_supports" } ] }, { "id": "forensic-review", "type": "task", "label": "Analyst forensic review", "config": { "assignee": "analyst", "description": "Analyze toolmark artifacts to confirm the breach scope.", "instructions": "Review the cited GOST tunnel process and shadow copy deletion scripts. Check Registry activity for evidence of share traversal to confirm the encryption target." }, "parents": [ { "id": "route-on-impact", "branch": "default" }, { "id": "route-on-impact", "branch": "on_unavailable" }, { "id": "isolate-host" } ] }, { "id": "closure", "type": "task", "label": "Hunt closure", "config": { "assignee": "analyst", "description": "Finalize reporting and tuning.", "instructions": "Record all found Akira artifacts. If the shadow-copy-deletion query was successful, recommend it for a standing detection rule." }, "parents": [ { "id": "route-on-impact", "branch": "on_refutes" }, { "id": "forensic-review" } ] } ] }