Ransomware Series: Akira Precursor - CloudFlare Tunnel and Local Account Creatio

Ibrahim Saud@tektrix

•updated 11 days ago•0•0•2

Detects reconnaissance and persistence behaviors associated with the Akira ransomware attack chain, specifically the execution of the Cloudflare Tunnel daemon for remote access or the creation/modification of local user accounts via standard Windows tools.