Up a Creek Without a Command Line: Mapping an Akira Ransomware Attack
How Huntress researchers reconstructed an Akira ransomware attack using Registry artifacts, Akira logs, and other post-compromise evidence.
Hanging out where digital forensics meets incident response and threat intel.
“I was in grad school in 1994, and came across something interesting. The "finger" app was described as a 'security vulnerability'. I had no idea why this was the case, so I asked the senior sysadmin for the curriculum. She looked at me, smiled, and walked away without saying a word.” So began Harlan’s affinity for digging into head-scratching security questions.
Harlan is Staff Threat Intel Analyst, Adversary Tactics here at Huntress, poised at the intersection of digital forensics and incident response, threat hunting, and threat intel.
He leverages his extensive 20+ years of DFIR (Digital Forensics and Incident Response) experience to focus on threat intelligence, which is essentially unraveling how threat actors are looking to gain entry on endpoints and finding ways to detect it sooner in the attack cycle. Prior to Huntress, Harlan ran the internal SOC at EY.
But he doesn’t keep it all to himself, Harlan is an accomplished public speaker, writer, innovative researcher, and analyst. As a published author (besides the below blog posts!), Harlan has published 9 books, including the first book of its kind offering an analysis of the Windows Registry.
When he’s not at work, Harlan enjoys programming in Perl, reading, writing, and working around the farm.
What's your favorite cybersecurity tip, Harlan?
“Do the basics well, beginning with an asset inventory and attack surface reduction.”
How Huntress researchers reconstructed an Akira ransomware attack using Registry artifacts, Akira logs, and other post-compromise evidence.
Threat actors exploited Samsung MagicINFO to install AnyDesk, disable Defender, and compile a Monero miner directly on a victim endpoint. Learn the detection signals.
Huntress analysts reconstructed a three-week INC ransomware attack from endpoint data, uncovering a 17-day lull despite missing process telemetry.
Huntress has recently seen two incidents involving Settra, a ransomware variant that was first publicly reported in June 2026.
See how a threat actor used SQL injection and BadIIS to gain persistence, disable Windows Defender, and quietly install a cryptominer.
A recent investigation uncovered an Akira affiliate abusing a website owned by file-sharing app LimeWire for data exfiltration. Here's how the attack unfolded.