Akira Ransomware: ProgramData Binary Execution with Shadow Copy Deletion

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•1

Detects Akira ransomware deployment by monitoring the execution of suspected binary files (n.exe or locker.exe) from the C:\ProgramData directory, correlated with system recovery inhibition commands (e.g., vssadmin, wmic, bcdedit) executed on the same host within a 2-hour timeframe.