RansomHub Revisited: New Front-Runner in the Ransomware-as-a-Service Marketplace
Discover how RansomHub is rising in the ransomware landscape, using tools like Atera and Splashtop, reconnaissance tactics, and double extortion techniques.
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Maria Geronikolou
Cyber Analyst
Share
06
Feb 2025
In a previous Inside the SOC blog, Darktrace investigated RansomHub and its growing impact on the threat landscape due to its use by the ShadowSyndicate threat group. Here, RansomHub is revisited with new insights on this ransomware-as-a-service (RaaS) platform that has rapidly gained traction among threat actors of late.
In recent months, Darktrace’s Threat Research team has noted a significant uptick in potential compromises affecting the fleet, indicating that RansomHub is becoming a preferred tool for cybercriminals. This article delves into the increasing adoption of RansomHub, the tactics, techniques, and procedures (TTPs) employed by its affiliates, and the broader implications for organizations striving to protect their systems.
RansomHub overview & background
One notable threat group to have transitioned from ALPHV (BlackCat)-aligned operations to RansomHub-aligned operations is ScatteredSpider [1]. The adoption of RansomHub by ScatteredSpider and other threat actors suggests a possible power shift among threat groups, given the increasing number of cybercriminals adopting it, including those who previously relied on ALPHV’s malware code [2].
ALPHV was a RaaS strain used by cybercriminals to breach Change Healthcare in February 2024 [2]. However, there are claims that the ransom payment never reached the affiliate using ALPHV, leading to a loss of trust in the RaaS. Around the same time, Operation Cronos resulted in the shutdown of LockBit and the abandonment of its affiliates [2]. Consequently, RansomHub emerged as a prominent RaaS successor.
RansomHub targets
The RansomHub ransomware group has been observed targeting various sectors, including critical infrastructure, financial and government services, and the healthcare sector [4]. They use ransomware variants rewritten in GoLang to target both Windows and Linux systems [5]. RansomHub is known for employing double extortion attacks, encrypting data using “Curve25519” encryption [6].
RansomHub tactics and techniques
The attackers leverage phishing attacks and social engineering techniques to lure their victims. Once access is gained, they use sophisticated tools to maintain control over compromised networks and exploit vulnerabilities in systems like Windows, Linux, ESXI, and NAS.
In more recent RansomHub attacks, tools such as Atera and Splashtop have been used to facilitate remote access, while NetScan has been employed to discover and retrieve information about network devices [7].
External researchers have observed that RansomHub uses several legitimate tools, or a tactic known as Living-off-the-Land (LOTL), to carry out their attacks. These tools include:
SecretServerSecretStealer: A PowerShell script that allows for the decryption of passwords [1].
Ngrok: A legitimate reverse proxy tool that creates a secure tunnel to servers located behind firewalls, used by the group for lateral movement and data exfiltration.
Remmina: An open-source remote desktop client for POSIX-based operating systems, enabling threat actors to access remote services [1].
By using these legitimate tools instead of traditional malware, RansomHub can avoid detection and maintain a lower profile during their operations.
Darktrace’s Coverage of RansomHub
Darktrace’s Security Operations Center (SOC) detected several notable cases of likely RansomHub activity across the customer base in recent months. In all instances, threat actors performed network scanning and brute force activities.
During the investigation of a confirmed RansomHub attack in January 2025, the Darktrace Threat Research team identified multiple authentication attempts as attackers tried to retrieve valid credentials. It is plausible that the attackers gained entry to customer environments through their Remote Desktop (RD) web server. Following this, various RDP connections were made to pivot to other devices within the network.
The common element among the cases investigated was that, in most instances, devices were seen performing outgoing connections to splashtop[.]com, a remote access and support software service, after the scanning activity had occurred. On one customer network, following this activity, the same device was seen connecting to the domain agent-api[.]atera[.]com and IP 20.37.139[.]187, which are seemingly linked to Atera, a Remote Monitoring and Management (RMM) tool.
Figure 1: Model Alert Log of an affected device making connections to *atera[.]com.
In a separate case, a Darktrace observed a device attempting to perform SMB scanning activity, trying to connect to multiple internal devices over port 445. Cyber AI Analyst was able to detect and correlate these individual connections into a single reconnaissance incident.
Similar connections to Remote Monitoring and Management (RMM) tools were also detected in a different customer environment, as alerted by Darktrace’s SOC. Unusual connections to Splashtop and Atera were made from the alerted device. Following this, the same device was observed sending a large volume of data over SSH Rclone to a rare external endpoint on the unusual port 448, triggered multiple models in Darktrace / NETWORK.
Figure 2: Advanced Search graph demonstrating the rarity of the external IP 38.244.145[.]85 used for data exfiltration.
Figure 3: Model Alert Log displaying information related to the suspicious IP, including the port used and its rarity for the network.
In the cases observed, data exfiltration occurred alongside the encryption of files likely indicating double extortion tactics. In September 2024, the Darktrace’s Threat Research team identified a 6-digit alphanumeric additional extension similar to “.293ac3”. This case was closely linked to a RansomHub attack, which was also analyzed in a different blog post by Darktrace [8].
Figure 4: Event Log displaying the extension “.293ac3” being appended to encrypted files on an affected customer network.
Conclusion
RansomHub exemplifies the evolving RaaS ecosystem, where threat actors capitalize on ready-made platforms to launch sophisticated attacks with ease. The activities observed highlight its growing popularity among cybercriminals. The analysis showed that the different attacks investigated followed a similar pattern of activity.
First, attackers perform reconnaissance activities, including widespread scanning from multiple devices and reverse DNS sweeps. They then use high-privileged credentials to pivot among devices and establish remote connections using RMM tools such as Atera. A common element among most attacks that reached the data encryption stage is the use of a 6-digit alphanumeric extension.
In all cases, Darktrace alerted on the unusual activities observed, creating not only model alerts but also Cyber AI Analyst incidents. Both Darktrace Security Operations Support and Darktrace Managed Threat Detection services provided 24/7 assistance to clients affected by RansomHub. The analyst team continued investigating these incidents, gathering data and IoCs seen in the RansomHub incidents, providing valuable insight and guidance throughout the process.
As RansomHub continues to gain traction, it serves as a stark reminder of the need for robust cybersecurity measures, proactive threat intelligence, and continued vigilance.
Credit to Maria Geronikolou (Cyber Analyst) and Nahisha Nobregas (Senior Cyber Analyst)
[related-resource]
Appendices
Darktrace Model Detections
Network Reconnaissance
o Device / Network Scan
o Device / ICMP Address Scan
o Device / RDP Scan
o Device / Anomalous LDAP Root Searches
o Anomalous Connection / SMB Enumeration
o Device / Spike in LDAP Activity
o Device / Suspicious Network Scan Activity
Lateral Movement
o Device / Multiple Lateral Movement Model Alerts
o Device / Increase in New RPC Services
o Device / New or Uncommon WMI Activity
o Device / Possible SMB/NTLM Brute Force
o Device / SMB Session Brute Force (Non-Admin)
o Device / Anomalous NTLM Brute Force
o Compliance / Default Credential Usage
o Compliance / Outgoing NTLM Request from DC
C2 Activity
o Anomalous Server Activity / Outgoing from Server
o Anomalous Connection / Multiple Connections to New External TCP Port
o Unusual Activity / Unusual External Activity
o Compliance / Remote Management Tool On Server
Data Exfiltration
o Unusual Activity / Enhanced Unusual External Data Transfer
o Anomalous Connection / Outbound SSH to Unusual Port
o Compliance / SSH to Rare External Destination
o Unusual Activity / Unusual External Data to New Endpoint
o Unusual Activity / Unusual External Data Transfer
o Attack Path Modelling / Unusual Data Transfer on Critical Attack Path
o Compliance / Possible Unencrypted Password File On Server
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Inside Akira’s SonicWall Campaign: Darktrace’s Detection and Response
Starting in July 2025, Akira ransomware attacks surged globally, targeting SonicWall SSL VPN devices. In August, Darktrace detected suspicious activity in a US network, including scanning, lateral movement, and data exfiltration. A compromised SonicWall VPN server linked the incident to the broader Akira campaign exploiting known vulnerabilities.
Darktrace exposed a cybercrime-as-a-service campaign using Python and Go-based malware, Docker containerization, and a full operator UI. With DDoS-as-a-service features, modular APIs, and advanced evasion, this platform highlights the need for defenders to monitor cloud workloads, container orchestration, and API activity to counter evolving threats.
SEO Poisoning and Fake PuTTY sites: Darktrace’s Investigation into the Oyster backdoor
SEO poisoning is a malicious tactic where threat actors manipulate search engine rankings to promote deceptive websites. These sites often mimic legitimate software downloads, delivering malware like the Oyster backdoor. Learn about Darktrace’s investigation into the tactics used to deliver Oyster via fake PuTTY sites and manipulate search visibility.
How a Major Civil Engineering Company Reduced MTTR across Network, Email and the Cloud with Darktrace
Asking more of the information security team
“What more can we be doing to secure the company?” is a great question for any cyber professional to hear from their Board of Directors. After successfully defeating a series of attacks and seeing the potential for AI tools to supercharge incoming threats, a UK-based civil engineering company’s security team had the answer: Darktrace.
“When things are coming at you at machine speed, you need machine speed to fight it off – it’s as simple as that,” said their Information Security Manager. “There were incidents where it took us a few hours to get to the bottom of what was going on. Darktrace changed that.”
Prevention was also the best cure. A peer organization in the same sector was still in business continuity measures 18 months after an attack, and the security team did not want to risk that level of business disruption.
Legacy tools were not meeting the team’s desired speed or accuracy
The company’s native SaaS email platform took between two and 14 days to alert on suspicious emails, with another email security tool flagging malicious emails after up to 24 days. After receiving an alert, responses often took a couple of days to coordinate. The team was losing precious time.
Beyond long detection and response times, the old email security platform was no longer performing: 19% of incoming spam was missed. Of even more concern: 6% of phishing emails reached users’ inboxes, and malware and ransomware email was also still getting through, with 0.3% of such email-borne payloads reaching user inboxes.
Choosing Darktrace
“When evaluating tools in 2023, only Darktrace had what I was looking for: an existing, mature, AI-based cybersecurity solution. ChatGPT had just come out and a lot of companies were saying ‘AI this’ and ‘AI that’. Then you’d take a look, and it was all rules- and cases-based, not AI at all,” their Information Security Manager.
The team knew that, with AI-enabled attacks on the horizon, a cybersecurity company that had already built, fielded, and matured an AI-powered cyber defense would give the security team the ability to fend off machine-speed attacks at the same pace as the attackers.
Darktrace accomplishes this with multi-layered AI that learns each organization’s normal business operations. With this detailed level of understanding, Darktrace’s Self-Learning AI can recognize unusual activity that may indicate a cyber-attack, and works to neutralize the threat with precise response actions. And it does this all at machine speed and with minimal disruption.
On the morning the team was due to present its findings, the session was cancelled – for a good reason. The Board didn’t feel further discussion was necessary because the case for Darktrace was so conclusive. The CEO described the Darktrace option as ‘an insurance policy we can’t do without’.
Saving time with Darktrace / EMAIL
Darktrace / EMAIL reduced the discovery, alert, and response process from days or weeks to seconds .
Darktrace / EMAIL automates what was originally a time-consuming and repetitive process. The team has recovered between eight and 10 working hours a week by automating much of this process using / EMAIL.
Today, Darktrace / EMAIL prevents phishing emails from reaching employees’ inboxes. The volume of hostile and unsolicited email fell to a third of its original level after Darktrace / EMAIL was set up.
Further savings with Darktrace / NETWORK and Darktrace / IDENTITY
Since its success with Darktrace / EMAIL, the company adopted two more products from the Darktrace ActiveAI Security Platform – Darktrace / NETWORK and Darktrace / IDENTITY.
These have further contributed to cost savings. An initial plan to build a 24/7 SOC would have required hiring and retaining six additional analysts, rather than the two that currently use Darktrace, costing an additional £220,000 per year in salary. With Darktrace, the existing analysts have the tools needed to become more effective and impactful.
An additional benefit: Darktrace adoption has lowered the company’s cyber insurance premiums. The security team can reallocate this budget to proactive projects.
Detection of novel threats provides reassurance
Darktrace’s unique approach to cybersecurity added a key benefit. The team’s previous tool took a rules-based approach – which was only good if the next attack featured the same characteristics as the ones on which the tool was trained.
“Darktrace looks for anomalous behavior, and we needed something that detected and responded based on use cases, not rules that might be out of date or too prescriptive,” their Information Security Manager. “Our existing provider could take a couple of days to update rules and signatures, and in this game, speed is of the essence. Darktrace just does everything we need - without delay.”
Where rules-based tools must wait for a threat to emerge before beginning to detect and respond to it, Darktrace identifies and protects against unknown and novel threats, speeding identification, response, and recovery, minimizing business disruption as a result.
Looking to the future
With Darktrace in place, the UK-based civil engineering company team has reallocated time and resources usually spent on detection and alerting to now tackle more sophisticated, strategic challenges. Darktrace has also equipped the team with far better and more regularly updated visibility into potential vulnerabilities.
“One thing that frustrates me a little is penetration testing; our ISO accreditation mandates a penetration test at least once a year, but the results could be out of date the next day,” their Information Security Manager. “Darktrace / Proactive Exposure Management will give me that view in real time – we can run it daily if needed - and that’s going to be a really effective workbench for my team.”
As the company looks to further develop its security posture, Darktrace remains poised to evolve alongside its partner.
Inside Akira’s SonicWall Campaign: Darktrace’s Detection and Response
Introduction: Background on Akira SonicWall campaign
Between July and August 2025, security teams worldwide observed a surge in Akira ransomware incidents involving SonicWall SSL VPN devices [1]. Initially believed to be the result of an unknown zero-day vulnerability, SonicWall later released an advisory announcing that the activity was strongly linked to a previously disclosed vulnerability, CVE-2024-40766, first identified over a year earlier [2].
On August 20, 2025, Darktrace observed unusual activity on the network of a customer in the US. Darktrace detected a range of suspicious activity, including network scanning and reconnaissance, lateral movement, privilege escalation, and data exfiltration. One of the compromised devices was later identified as a SonicWall virtual private network (VPN) server, suggesting that the incident was part of the broader Akira ransomware campaign targeting SonicWall technology.
As the customer was subscribed to the Managed Detection and Response (MDR) service, Darktrace’s Security Operations Centre (SOC) team was able to rapidly triage critical alerts, restrict the activity of affected devices, and notify the customer of the threat. As a result, the impact of the attack was limited - approximately 2 GiB of data had been observed leaving the network, but any further escalation of malicious activity was stopped.
Threat Overview
CVE-2024-40766 and other misconfigurations
CVE-2024-40766 is an improper access control vulnerability in SonicWall’s SonicOS, affecting Gen 5, Gen 6, and Gen 7 devices running SonicOS version 7.0.1 5035 and earlier [3]. The vulnerability was disclosed on August 23, 2024, with a patch released the same day. Shortly after, it was reported to be exploited in the wild by Akira ransomware affiliates and others [4].
Almost a year later, the same vulnerability is being actively targeted again by the Akira ransomware group. In addition to exploiting unpatched devices affected by CVE-2024-40766, security researchers have identified three other risks potentially being leveraged by the group [5]:
*The Virtual Office Portal can be used to initially set up MFA/TOTP configurations for SSLVPN users.
Thus, even if SonicWall devices were patched, threat actors could still target them for initial access by reusing previously stolen credentials and exploiting other misconfigurations.
Akira Ransomware
Akira ransomware was first observed in the wild in March 2023 and has since become one of the most prolific ransomware strains across the threat landscape [6]. The group operates under a Ransomware-as-a-Service (RaaS) model and frequently uses double extortion tactics, pressuring victims to pay not only to decrypt files but also to prevent the public release of sensitive exfiltrated data.
The ransomware initially targeted Windows systems, but a Linux variant was later observed targeting VMware ESXi virtual machines [7]. In 2024, it was assessed that Akira would continue to target ESXi hypervisors, making attacks highly disruptive due to the central role of virtualisation in large-scale cloud deployments. Encrypting the ESXi file system enables rapid and widespread encryption with minimal lateral movement or credential theft. The lack of comprehensive security protections on many ESXi hypervisors also makes them an attractive target for ransomware operators [8].
Victimology
Akira is known to target organizations across multiple sectors, most notably those in manufacturing, education, and healthcare. These targets span multiple geographic regions, including North America, Latin America, Europe and Asia-Pacific [9].
Figure 1: Geographical distribution of organization’s affected by Akira ransomware in 2025 [9].
Common Tactics, Techniques and Procedures (TTPs) [7][10]
Initial Access Targets remote access services such as RDP and VPN through vulnerability exploitation or stolen credentials.
Reconnaissance Uses network scanning tools like SoftPerfect and Advanced IP Scanner to map the environment and identify targets.
Lateral Movement Moves laterally using legitimate administrative tools, typically via RDP.
Persistence Employs techniques such as Kerberoasting and pass-the-hash, and tools like Mimikatz to extract credentials. Known to create new domain accounts to maintain access.
Command and Control Utilizes remote access tools including AnyDesk, RustDesk, Ngrok, and Cloudflare Tunnel.
Exfiltration Uses tools such as FileZilla, WinRAR, WinSCP, and Rclone. Data is exfiltrated via protocols like FTP and SFTP, or through cloud storage services such as Mega.
Darktrace’s Coverage of Akira ransomware
Reconnaissance
Darktrace first detected of unusual network activity around 05:10 UTC, when a desktop device was observed performing a network scan and making an unusual number of DCE-RPC requests to the endpoint mapper (epmapper) service. Network scans are typically used to identify open ports, while querying the epmapper service can reveal exposed RPC services on the network.
Multiple other devices were also later seen with similar reconnaissance activity, and use of the Advanced IP Scanner tool, indicated by connections to the domain advanced-ip-scanner[.]com.
Lateral movement
Shortly after the initial reconnaissance, the same desktop device exhibited unusual use of administrative tools. Darktrace observed the user agent “Ruby WinRM Client” and the URI “/wsman” as the device initiated a rare outbound Windows Remote Management (WinRM) connection to two domain controllers (REDACTED-dc1 and REDACTED-dc2). WinRM is a Microsoft service that uses the WS-Management (WSMan) protocol to enable remote management and control of network devices.
Darktrace also observed the desktop device connecting to an ESXi device (REDACTED-esxi1) via RDP using an LDAP service credential, likely with administrative privileges.
Credential access
At around 06:26 UTC, the desktop device was seen fetching an Active Directory certificate from the domain controller (REDACTED-dc1) by making a DCE-RPC request to the ICertPassage service. Shortly after, the device made a Kerberos login using the administrative credential.
Figure 3: Darktrace’s detection of the of anomalous certificate download and subsequent Kerberos login.
Further investigation into the device’s event logs revealed a chain of connections that Darktrace’s researchers believe demonstrates a credential access technique known as “UnPAC the hash.”
This method begins with pre-authentication using Kerberos’ Public Key Cryptography for Initial Authentication (PKINIT), allowing the client to use an X.509 certificate to obtain a Ticket Granting Ticket (TGT) from the Key Distribution Center (KDC) instead of a password.
The next stage involves User-to-User (U2U) authentication when requesting a Service Ticket (ST) from the KDC. Within Darktrace's visibility of this traffic, U2U was indicated by the client and service principal names within the ST request being identical. Because PKINIT was used earlier, the returned ST contains the NTLM hash of the credential, which can then be extracted and abused for lateral movement or privilege escalation [11].
Figure 4: Flowchart of Kerberos PKINIT pre-authentication and U2U authentication [12]
Figure 5: Device event log showing the Kerberos Login and Kerberos Ticket events
Analysis of the desktop device’s event logs revealed a repeated sequence of suspicious activity across multiple credentials. Each sequence included a DCE-RPC ICertPassage request to download a certificate, followed by a Kerberos login event indicating PKINIT pre-authentication, and then a Kerberos ticket event consistent with User-to-User (U2U) authentication.
Darktrace identified this pattern as highly unusual. Cyber AI Analyst determined that the device used at least 15 different credentials for Kerberos logins over the course of the attack.
By compromising multiple credentials, the threat actor likely aimed to escalate privileges and facilitate further malicious activity, including lateral movement. One of the credentials obtained via the “UnPAC the hash” technique was later observed being used in an RDP session to the domain controller (REDACTED-dc2).
C2 / Additional tooling
At 06:44 UTC, the domain controller (REDACTED-dc2) was observed initiating a connection to temp[.]sh, a temporary cloud hosting service. Open-source intelligence (OSINT) reporting indicates that this service is commonly used by threat actors to host and distribute malicious payloads, including ransomware [13].
Shortly afterward, the ESXi device was observed downloading an executable named “vmwaretools” from the rare external endpoint 137.184.243[.]69, using the user agent “Wget.” The repeated outbound connections to this IP suggest potential command-and-control (C2) activity.
Figure 6: Cyber AI Analyst investigation into the suspicious file download and suspected C2 activity between the ESXI device and the external endpoint 137.184.243[.]69.
Figure 7: Packet capture (PCAP) of connections between the ESXi device and 137.184.243[.]69.
Data exfiltration
The first signs of data exfiltration were observed at around 7:00 UTC. Both the domain controller (REDACTED-dc2) and a likely SonicWall VPN device were seen uploading approximately 2 GB of data via SSH to the rare external endpoint 66.165.243[.]39 (AS29802 HVC-AS). OSINT sources have since identified this IP as an indicator of compromise (IoC) associated with the Akira ransomware group, known to use it for data exfiltration [14].
Figure 8: Cyber AI Analyst incident view highlighting multiple unusual events across several devices on August 20. Notably, it includes the “Unusual External Data Transfer” event, which corresponds to the anomalous 2 GB data upload to the known Akira-associated endpoint 66.165.243[.]39.
Cyber AI Analyst
Throughout the course of the attack, Darktrace’s Cyber AI Analyst autonomously investigated the anomalous activity as it unfolded and correlated related events into a single, cohesive incident. Rather than treating each alert as isolated, Cyber AI Analyst linked them together to reveal the broader narrative of compromise. This holistic view enabled the customer to understand the full scope of the attack, including all associated activities and affected assets that might otherwise have been dismissed as unrelated.
Figure 9: Overview of Cyber AI Analyst’s investigation, correlating all related internal and external security events across affected devices into a single pane of glass.
Containing the attack
In response to the multiple anomalous activities observed across the network, Darktrace's Autonomous Response initiated targeted mitigation actions to contain the attack. These included:
Blocking connections to known malicious or rare external endpoints, such as 137.184.243[.]69, 66.165.243[.]39, and advanced-ip-scanner[.]com.
Blocking internal traffic to sensitive ports, including 88 (Kerberos), 3389 (RDP), and 49339 (DCE-RPC), to disrupt lateral movement and credential abuse.
Enforcing a block on all outgoing connections from affected devices to contain potential data exfiltration and C2 activity.
Figure 10: Autonomous Response actions taken by Darktrace on an affected device, including the blocking of malicious external endpoints and internal service ports.
Managed Detection and Response
As this customer was an MDR subscriber, multiple Enhanced Monitoring alerts—high-fidelity models designed to detect activity indicative of compromise—were triggered across the network. These alerts prompted immediate investigation by Darktrace’s SOC team.
Upon determining that the activity was likely linked to an Akira ransomware attack, Darktrace analysts swiftly acted to contain the threat. At around 08:05 UTC, devices suspected of being compromised were quarantined, and the customer was promptly notified, enabling them to begin their own remediation procedures without delay.
A wider campaign?
Darktrace’s SOC and Threat Research teams identified at least three additional incidents likely linked to the same campaign. All targeted organizations were based in the US, spanning various industries, and each have indications of using SonicWall VPN, indicating it had likely been targeted for initial access.
Across these incidents, similar patterns emerged. In each case, a suspicious executable named “vmwaretools” was downloaded from the endpoint 85.239.52[.]96 using the user agent “Wget”, bearing some resemblance to the file downloads seen in the incident described here. Data exfiltration was also observed via SSH to the endpoints 107.155.69[.]42 and 107.155.93[.]154, both of which belong to the same ASN also seen in the incident described in this blog: S29802 HVC-AS. Notably, 107.155.93[.]154 has been reported in OSINT as an indicator associated with Akira ransomware activity [15]. Further recent Akira ransomware cases have been observed involving SonicWall VPN, where no similar executable file downloads were observed, but SSH exfiltration to the same ASN was. These overlapping and non-overlapping TTPs may reflect the blurring lines between different affiliates operating under the same RaaS.
Lessons from the campaign
This campaign by Akira ransomware actors underscores the critical importance of maintaining up-to-date patching practices. Threat actors continue to exploit previously disclosed vulnerabilities, not just zero-days, highlighting the need for ongoing vigilance even after patches are released. It also demonstrates how misconfigurations and overlooked weaknesses can be leveraged for initial access or privilege escalation, even in otherwise well-maintained environments.
Darktrace’s observations further reveal that ransomware actors are increasingly relying on legitimate administrative tools, such as WinRM, to blend in with normal network activity and evade detection. In addition to previously documented Kerberos-based credential access techniques like Kerberoasting and pass-the-hash, this campaign featured the use of UnPAC the hash to extract NTLM hashes via PKINIT and U2U authentication for lateral movement or privilege escalation.
Credit to Emily Megan Lim (Senior Cyber Analyst), Vivek Rajan (Senior Cyber Analyst), Ryan Traill (Analyst Content Lead), and Sam Lister (Specialist Security Researcher)
Appendices
Darktrace Model Detections
Anomalous Connection / Active Remote Desktop Tunnel
Anomalous Connection / Data Sent to Rare Domain
Anomalous Connection / New User Agent to IP Without Hostname
Anomalous Connection / Possible Data Staging and External Upload
Anomalous Connection / Rare WinRM Incoming
Anomalous Connection / Rare WinRM Outgoing
Anomalous Connection / Uncommon 1 GiB Outbound
Anomalous Connection / Unusual Admin RDP Session
Anomalous Connection / Unusual Incoming Long Remote Desktop Session
Anomalous Connection / Unusual Incoming Long SSH Session
Anomalous Connection / Unusual Long SSH Session
Anomalous File / EXE from Rare External Location
Anomalous Server Activity / Anomalous External Activity from Critical Network Device
Anomalous Server Activity / Outgoing from Server
Anomalous Server Activity / Rare External from Server
Compliance / Default Credential Usage
Compliance / High Priority Compliance Model Alert
Compliance / Outgoing NTLM Request from DC
Compliance / SSH to Rare External Destination
Compromise / Large Number of Suspicious Successful Connections
Compromise / Sustained TCP Beaconing Activity To Rare Endpoint
Device / Anomalous Certificate Download Activity
Device / Anomalous SSH Followed By Multiple Model Alerts
Device / Anonymous NTLM Logins
Device / Attack and Recon Tools
Device / ICMP Address Scan
Device / Large Number of Model Alerts
Device / Network Range Scan
Device / Network Scan
Device / New User Agent To Internal Server
Device / Possible SMB/NTLM Brute Force
Device / Possible SMB/NTLM Reconnaissance
Device / RDP Scan
Device / Reverse DNS Sweep
Device / Suspicious SMB Scanning Activity
Device / UDP Enumeration
Unusual Activity / Unusual External Data to New Endpoint
Unusual Activity / Unusual External Data Transfer
User / Multiple Uncommon New Credentials on Device
User / New Admin Credentials on Client
User / New Admin Credentials on Server
Enhanced Monitoring Models
Compromise / Anomalous Certificate Download and Kerberos Login
Device / Initial Attack Chain Activity
Device / Large Number of Model Alerts from Critical Network Device
Device / Multiple Lateral Movement Model Alerts
Device / Suspicious Network Scan Activity
Unusual Activity / Enhanced Unusual External Data Transfer
Antigena/Autonomous Response Models
Antigena / Network / External Threat / Antigena File then New Outbound Block
![Model Alert Log of an affected device making connections to *atera[.]com.](https://cdn.prod.website-files.com/626ff4d25aca2edf4325ff97/67a4f4c351229b3135812411_Screenshot%202025-02-06%20at%209.43.19%E2%80%AFAM.avif)
![Advanced Search graph demonstrating the rarity of the external IP 38.244.145[.]85 used for data exfiltration.](https://cdn.prod.website-files.com/626ff4d25aca2edf4325ff97/67a4f4ef3ae41e42fd9511e5_Screenshot%202025-02-06%20at%209.44.06%E2%80%AFAM.avif)
.avif)
![Geographical distribution of organization’s affected by Akira ransomware in 2025 [9].](https://cdn.prod.website-files.com/626ff4d25aca2edf4325ff97/68e684a90c107be86fa5c2e0_Screenshot%202025-10-08%20at%207.53.20%E2%80%AFAM.png)
![Flowchart of Kerberos PKINIT pre-authentication and U2U authentication [12].](https://cdn.prod.website-files.com/626ff4d25aca2edf4325ff97/68e53a2b5e9394d5a5cbebb7_Screenshot%202025-10-07%20at%209.04.43%E2%80%AFAM.png)
![Cyber AI Analyst investigation into the suspicious file download and suspected C2 activity between the ESXI device and the external endpoint 137.184.243[.]69.](https://cdn.prod.website-files.com/626ff4d25aca2edf4325ff97/68e53a8ea01e348d5a62a6c3_Screenshot%202025-10-07%20at%209.06.31%E2%80%AFAM.png)
![Packet capture (PCAP) of connections between the ESXi device and 137.184.243[.]69.](https://cdn.prod.website-files.com/626ff4d25aca2edf4325ff97/68e53ae5304f84a4192967db_Screenshot%202025-10-07%20at%209.07.53%E2%80%AFAM.png)
![Cyber AI Analyst incident view highlighting multiple unusual events across several devices on August 20. Notably, it includes the “Unusual External Data Transfer” event, which corresponds to the anomalous 2 GB data upload to the known Akira-associated endpoint 66.165.243[.]39.](https://cdn.prod.website-files.com/626ff4d25aca2edf4325ff97/68e53b26d90343a0a6ab3bb2_Screenshot%202025-10-07%20at%209.09.02%E2%80%AFAM.png)
