No EDR, no problem: how Huntress rebuilt an Akira ransomware attack from forensic leftovers

The Akira ransomware attack analyzed by Huntress succeeded in part because no EDR solution was deployed, leaving defenders reliant on passive forensic artifacts like Windows Event Logs and Registry entries to reconstruct the attack timeline. Threat actors leveraged tools such as GOST (for tunneling) and Rclone (for data exfiltration), both of which leave distinct 'toolmarks' that can be recovered post-incident — but only if native logging was enabled and retained. This highlights a critical dependency: without proactive telemetry collection, incident responders are forced into a reactive, evidence-scavenging posture that slows containment and increases damage. Organizations without EDR are not invisible to attackers, but they are largely invisible to themselves. Comprehensive logging is not a luxury — it is a foundational control that directly affects both detection speed and recovery quality.