Cyberattacks are often associated with hackers installing new and unknown malware on the victim's system. But that doesn't always have to be the case. In a recent ransomware family case, Akira the attackers used a method called Living off the Land (LOTL). It is based on utilize already installed and fully legitimate IT tools to carry out the attack – and thus hide behind what looks like normal IT operations.

The attack was stopped by Barracuda's XDR Team, and the lessons are many for companies of all sizes.

This is how the attack happened

The attack took place early in the morning on a national holiday. Cybercriminals, armed with the flexible Ransomware-as-a-Servicesolution, Akira, targeted a domain management server – a central function for logging in and accessing files and applications.

Advertisement

The server had the remote management tool Datto Remote Monitoring and Management (RMM) installed.

Instead of installing new malware, the attackers leveraged the RMM console along with previously installed backup clients to run scripts, change firewall settings, and disable security features—actions that looked like routine system administration and therefore did not raise suspicion.

When the files later started to be encrypted and received the extension .akira discovered Barracuda Managed XDR immediately the first encryption attempts. The server was immediately isolated and the attack was stopped before it could spread.

Lessons from the attack

1. The attackers did not install any new programs that would have triggered warning signals, but instead used already trusted tools.
2. The activity was similar to what a backup client might normally do, making the attack more difficult to distinguish from normal IT operations.
3. Akira is a Ransomware-as-a-Servicesolution that is rented out to different actors. Therefore, each attack looks different, which makes the threat more difficult to predict.

Restoration and recovery

After the attack was stopped, the Barracuda's team with the customer to isolate affected devices, remove the threats, scan for any remaining traces of Akira, and safely restore the systems.

In the next step, security policies were strengthened to reduce the risk of similar incidents in the future.

To counter this type of sophisticated attack required comprehensively XDR solutions which gives security teams full overview of networks, servers and devices. This makes it possible to detect anomalous behavior early – even when they are hidden behind already installed tools.