Akira Ransomware delete.me Marker File Creation in Windows and SYSVOL

Ethan Andrews@eandrews

•updated Jun 29, 2026•3•0•14

Detects the creation of 'delete.me' files in critical Windows directories (specifically C:\Windows and SYSVOL paths). This behavior is associated with the Akira ransomware, which uses these marker files to coordinate domain-wide encryption tasks, often executed by the System account during the preparation phase of an attack.