Akira Affiliate Attack Chain - AD Enum, WinRAR Staging, Exfiltration, and Campaign Tooling

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

Detects malicious activities associated with Akira ransomware affiliates, including Active Directory enumeration using AdFind, data staging via WinRAR, and exfiltration attempts utilizing tools like WinSCP, rclone, or MEGAcmd. The rule also monitors for the presence of campaign-specific malware binaries.