Akira - System Recovery Inhibition via VSS Deletion and Boot Repair Disable

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•0

Detects a burst of commands consistent with Akira ransomware's recovery inhibition phase, where multiple system recovery features are disabled or deleted (e.g., Volume Shadow Copies, Windows Backup Catalog, Boot Recovery) within a 5-minute window on the same endpoint.