No EDR, no problem: how Huntress rebuilt an Akira ransomware attack from forensic leftovers

Incident responders rarely get to watch an attack from the beginning. More often, security tooling arrives after the damage is done, either as part of the response or because a rollout was still underway when the attackers struck. That was the position Huntress found itself in this September, when its agent was deployed at an organisation that had already been hit by Akira ransomware.