[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fSb5xNZBlohpk3MP5MHJLW1k3zu1FIf5-jb1g2V26P-Q":3},{"article":4,"iocs":46,"watch_terms":60,"solutions":61,"lesson":156},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"c8e49129-ac44-46ec-a325-7181d843165c","No EDR, no problem: how Huntress rebuilt an Akira ransomware attack from forensic leftovers","no-edr-no-problem-how-huntress-rebuilt-an-akira-ransomware-attack-from-forensic--944524","Incident responders rarely get to watch an attack from the beginning. More often, security tooling arrives after the damage is done, either as part of the response or because a rollout was still underway when the attackers struck. That was the position Huntress found itself in this September, when its agent was deployed at an […] The post No EDR, no problem: how Huntress rebuilt an Akira ransomware attack from forensic leftovers appeared first on IT Security Guru.","Huntress researchers successfully rebuilt the timeline of an Akira ransomware attack by analyzing forensic artifacts like Windows Event Logs and Registry entries, despite the absence of EDR telemetry. The analysis revealed the use of GOST, Rclone, and standard Akira tactics, highlighting how \"toolmarks\" can provide crucial evidence even when direct command-line data is unavailable.","Huntress reconstructs Akira ransomware attack using forensic data without EDR telemetry.","https:\u002F\u002Fwww.itsecurityguru.org\u002F2026\u002F10\u002F08\u002Fno-edr-no-problem-how-huntress-rebuilt-an-akira-ransomware-attack-from-forensic-leftovers\u002F?utm_source=rss&utm_medium=rss&utm_campaign=no-edr-no-problem-how-huntress-rebuilt-an-akira-ransomware-attack-from-forensic-leftovers","https:\u002F\u002Fwww.itsecurityguru.org\u002Fwp-content\u002Fuploads\u002F2026\u002F10\u002FCyber-Attack-Pathway_-From-Intrusion-to-Ransomware.png","2026-10-08T10:13:47+00:00","2026-10-08T12:00:32.666194+00:00",8,[17,20],{"name":18,"type":19},"EDR","product",{"name":21,"type":22},"Huntress","vendor","c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73",{"id":23,"icon":25,"name":26,"slug":27},null,"Incident Response","incident-response",[29,34,39,41],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"02371804-cf6d-4449-98de-f1a2d4d9b266","Tools","tools",{"category":35},{"id":36,"icon":25,"name":37,"slug":38},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":40},{"id":23,"icon":25,"name":26,"slug":27},{"category":42},{"id":43,"icon":25,"name":44,"slug":45},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[47,51,54,57],{"type":48,"value":49,"context":50},"ip","64.227.4.134","GOST tunnel C2 communication",{"type":38,"value":52,"context":53},"GOST","Open-source proxy and tunnelling tool linked to Akira affiliate activity",{"type":38,"value":55,"context":56},"Rclone","Tool used for exfiltrating data to cloud storage",{"type":38,"value":58,"context":59},"Akira","Ransomware family",[21,18],{"controls":62,"vendors":150},[63,92,121],{"slug":64,"name":65,"problem":66,"products":67},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[68,76,84],{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"slug":93,"name":94,"problem":95,"products":96},"log-management","Log management and security data pipelines","Security logs are so expensive to collect and keep that teams drop the ones they need when an incident happens.",[97,105,113],{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"abstract-security","Abstract Security","\u002Fvendor-logos\u002Fabstract-security.png","abstract-pipelines","Abstract Pipelines","https:\u002F\u002Fwww.abstract.security\u002Fplatform\u002Fcollection","Collects security data from any source, normalises it in the pipeline and routes it to several destinations.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"cribl","Cribl","\u002Fvendor-logos\u002Fcribl.png","cribl-stream","Cribl Stream","https:\u002F\u002Fcribl.io\u002Fproducts\u002Fstream\u002F","Collects, reduces, redacts and routes data between sources and tools, keeps a full-fidelity copy in low-cost storage, and replays it when needed.",{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-transit","GreyMatter Transit","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Ftransit\u002F","Security data pipeline that normalises and routes telemetry and detects threats while the data is in motion, to cut lag and storage costs.",{"slug":122,"name":123,"problem":124,"products":125},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back.",[126,134,142],{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"veeam","Veeam","\u002Fvendor-logos\u002Fveeam.png","veeam-data-platform","Veeam Data Platform","https:\u002F\u002Fwww.veeam.com\u002Fproducts\u002Fveeam-data-platform.html","Backup and recovery for virtual, physical, cloud and SaaS workloads, with immutable storage options.",{"vendor_slug":135,"vendor_name":136,"vendor_logo":137,"product_slug":138,"product_name":139,"url":140,"description":141},"commvault","Commvault","\u002Fvendor-logos\u002Fcommvault.png","commvault-cloud","Commvault Cloud","https:\u002F\u002Fwww.commvault.com\u002Fplatform","Backup and recovery platform with immutable storage and recovery testing.",{"vendor_slug":143,"vendor_name":144,"vendor_logo":145,"product_slug":146,"product_name":147,"url":148,"description":149},"rubrik","Rubrik","\u002Fvendor-logos\u002Frubrik.png","zero-trust-data-protection","Rubrik Zero Trust Data Protection","https:\u002F\u002Fwww.rubrik.com\u002Fproducts\u002Fdata-protection","Air-gapped, immutable backup for on-premises, cloud and SaaS data, with threat detection in backups and orchestrated recovery.",[151],{"slug":152,"name":21,"logo_path":153,"roles":154},"huntress","\u002Fvendor-logos\u002Fhuntress.png",[155],"reported_by",{"slug":157,"title":158,"body":159,"framework_refs":160,"framework_notes":171},"akira-ransomware-reconstructed-from-forensic-crumbs-after-edr-gap","Akira Ransomware Reconstructed from Forensic Crumbs After EDR Gap","The Akira ransomware attack analyzed by Huntress succeeded in part because no EDR solution was deployed, leaving defenders reliant on passive forensic artifacts like Windows Event Logs and Registry entries to reconstruct the attack timeline. Threat actors leveraged tools such as GOST (for tunneling) and Rclone (for data exfiltration), both of which leave distinct 'toolmarks' that can be recovered post-incident — but only if native logging was enabled and retained. This highlights a critical dependency: without proactive telemetry collection, incident responders are forced into a reactive, evidence-scavenging posture that slows containment and increases damage. Organizations without EDR are not invisible to attackers, but they are largely invisible to themselves. Comprehensive logging is not a luxury — it is a foundational control that directly affects both detection speed and recovery quality.",[161,162,163,164,165,166,167,168,169,170],"CIS Control 8: Audit Log Management","CIS Control 10: Malware Defenses","CIS Control 13: Network Monitoring and Defense","NIST SP 800-61 Rev. 2: Computer Security Incident Handling Guide","NIST SP 800-92: Guide to Computer Security Log Management","NIST DE.CM-1: Network and system monitoring","NIST DE.AE-3: Event data aggregated and correlated","MITRE ATT&CK T1567.002: Exfiltration to Cloud Storage (Rclone)","MITRE ATT&CK T1572: Protocol Tunneling (GOST)","ITIL: Event Management \u002F Incident Management practices",{}]