Akira, LimeWire, and the Sour Taste of Data Exfiltration

Acknowledgments: Special thanks to the efforts of Michael Tigges, Anna Pham, Adam Mooney, and Samantha Shaw for their contributions to this investigation.

On May 29, the Huntress SOC detected unauthorized remote access to a domain controller on an organization. 

A closer inspection into the incident showed that the threat actor accessed a hypervisor within the victim’s environment and created a new server instance, using this new virtual machine to stage and launch the Akira ransomware. As this was a newly-instantiated virtual machine, it did not have the security tooling employed by the partner, including the Huntress agent, installed.

The VM operated by the threat actor gave us valuable information about the incident and the techniques used by this Akira affiliate. We also used telemetry from Windows Event Logs, Microsoft Edge browser history artifacts, and more to piece together what had happened. One of the more interesting parts of the incident that we found was the threat actor using a file transfer function owned by LimeWire – a file sharing client that you may have accidentally infected your family computer with in the early 2000s – as a likely data exfiltration mechanism. 

The incident

During the initial reporting of this incident, the impacted endpoint was taken offline, limiting our insight into some parts of the incident like initial access. However, we were able to see some of the threat actor’s activity based on the available EDR telemetry. 

We detected enumeration activity, revealing that the threat actor had used Notepad to open files (AdUsers.txt and AdComp.txt) and was reviewing output files associated with enumerating Active Directory users and computers.

Figure 1: Huntress detection of enumeration activity

The threat actor then pivoted to the organization’s file server, where we saw them using several freely available tools. They used WinRAR, an archival tool we’ve seen in previous attacks, to archive the contents of a share folder. Shortly after, they ran WinSCP, a free, open-source file manager and secure file transfer application, presumably to exfiltrate the staged data. 

A hypervisor twist

Another part of the incident soon emerged: the threat actor had accessed a hypervisor and created a new server instance, using this new virtual machine as a staging location from which they launched the Akira ransomware. 

As this was a newly instantiated virtual machine, it did not have the Huntress agent installed.

This tactic is not unheard of, but it is not one that has been frequently observed by the Huntress SOC, and also not one frequently seen being employed by ransomware affiliates (in particular, an Akira affiliate). The virtual machine file was provided to Huntress analysts in the form of a Windows virtual hard disk image (VHDX) file.

Figure 2: Virtual Machine File (via Explorer.exe)

To access the contents of the virtual machine, Huntress analysts mounted the VHDX file via the Disk Management utility, as shown in Figure 3, before accessing the NTFS volume via forensic tooling.

Figure 3: Virtual machine mounted via Disk Management utility

Another clue: The VHDX file

This virtual machine was not a pre-existing endpoint that was already running within the environment; this VM was reportedly instantiated by the threat actor. The virtual machine’s contents provided an interesting and insightful view into threat actor activity, even without the visibility provided by the Huntress EDR agent. For example, the analysis showed that the threat actor accessed the new endpoint, and within minutes of logging in, disabled Microsoft Defender, the only default security tooling in place. 

The threat actor then accessed shares and folders on other endpoints within the environment, and installed WinRAR, similar to what had been observed in the initial stages of the incident investigation. 

The threat actor accessed an archive that contained the various cross-platform versions of the Akira file encryptor executable before changing the name of one of those files to akira.exe. 

Next, the threat actor used the Microsoft Edge browser to access Bing, and search for the term “eayupload” before settling on Easyupload.io, a website that provides access to file uploads via drag-and-drop (as illustrated in Figure 4). This site is supported by LimeWire, which was once a popular free peer-to-peer music downloading software in the early 2000s, but since 2022 has rebranded into an NFT service and, more recently, a file-sharing platform. 

Figure 4: Easyupload.io by LimeWire Website

Shortly after accessing the LimeWire website, presumably to exfiltrate staged archives, the threat actor launched the akira.exe file encryptor against several mounted shares.

Data exfiltration and more 

The use of Easyupload.io/LimeWire (and WinSCP in the initial stages of the incident) during this attack is only one of many data exfiltration methods we’ve seen threat actors use. Huntress has provided extensive insight regarding data exfiltration from previously observed incidents, including the use of finger.exe, the use of backup utilities such as Restic, as well as the use of other utilities including s5cmd. Threat actors have also used MegaSYNC and cloud storage services.

Another piece of the analysis of the VM that stuck out to us is how quickly the threat actor progressed through their attack. Aside from immediately disabling Microsoft Defender so that they could launch the file encryptor uninhibited, there were no other defense evasion or anti-forensics techniques employed. 

The VM itself was not modified in any way to hide, obfuscate, or simply not record any of the artifacts or toolmarks included in the analysis, and as a result, log entries and other associated toolmarks of activity provided a pretty clear roadmap of the threat actor’s activities, including both the sequence and timing of their progression to ransomware deployment. The creation of the VM was clearly intentional, as it allowed the threat actor to completely avoid having to deal with obstacles presented by the customer’s security stack.  

Mitigations

Due in no small part to the breadth of our customer base, the Huntress SOC analyzes a wide range of threat actor activity, including ransomware deployment as we saw this incident. As Huntress has noted, while a specific variant or family of ransomware may be deployed, the attack itself may unfold in a much different manner than has been previously observed, due to the ransomware-as-a-service, or RaaS, affiliate model. Huntress has shared information about Akira affiliates before, and this opportunity presented itself in a very unusual way. 

For organizations, this incident underscores the need to monitor environments for unusual or malicious access; and to watch for the addition or creation of new endpoints within the environment.

Indicators of Compromise (IoCs)