Akira Ransomware Encryptor Execution: VSS Deletion and .akira Extension

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•2

Detects indicators of Akira ransomware activity, specifically the deletion of Volume Shadow Copies using vssadmin, the creation of known Akira ransom notes (akira_readme.txt, restore_files.txt), and the generation of files with the .akira extension.