Full Report
In a recent ransomware attack, a threat actor accessed the victim’s hypervisor and created a new virtual machine (VM) as a staging location from which they launched the Akira ransomware A forensic investigation into the VM contents revealed several tactics that the threat actor had taken, including using Easyupload.io, a file transfer website owned by the longtime file sharing application LimeWire, as a likely way to exfiltrate staged archives Our investigation showed that the attacker quickly progressed through their attack, disabling Microsoft Defender and installing WinRAR, an archival tool typically used by threat actors for staging data The use of EasyUpload/LimeWire adds to a long list of data exfiltration methods that we see threat actors using, including legitimate tools like backup utilities and cloud storage services
Analysis Summary