Akira - Lateral Movement via RDP After VPN Credential Theft

Ibrahim Saud@tektrix

•updated Jun 17, 2026•0•0•7

Detects accounts with first-time RDP logins to multiple systems (3 or more) within a short time window (30 minutes or less). This behavior is indicative of lateral movement, often seen after initial access via stolen VPN credentials, as observed with the Akira ransomware group.