Akira Ransomware Attack: Hypervisor Compromise, VM Creation, and Data Exfiltration via LimeWire

Summary

A threat actor breached a victim environment by accessing a hypervisor and creating a new virtual machine to stage and launch Akira ransomware. The investigation uncovered the use of Easyupload.io via LimeWire, WinRAR, and WinSCP for data staging and likely exfiltration. The attacker rapidly disabled Microsoft Defender on the new VM and made little effort to conceal their activities.

Source

bskyAkira Ransomware Attack: Hypervisor Compromise, VM Creation, and Data Exfiltration via LimeWirehendryadrian.com