How Acronis stops a ransomware attack. Step by step.
We follow a real attack from Akira - one of the world's most dangerous ransomware groups - and show where Acronis stops each step.
Are you ready for this call?
This is what it sounds like when Akira has just hit your largest customer.
It's 08:50 AM. Akira has already been in the network for 11 days.
The question is not if the call will come - but if you are prepared when it does.
Meet Akira
One of the world's most profitable ransomware groups right now.
Rapidly growing. Targets mid-sized and large enterprises.
Akira often manages to steal data before your security team has even reacted.
Akira is not just a hacking group - it's an entire organization. Technicians, salespeople, and negotiators work in parallel. To stop them, you need coverage at all levels.
How the attacker gets their first key.
- 1A fake Microsoft login tricks the user into giving up their password.
- 2With the account, the attacker accesses Microsoft 365 and your shared spaces.
- 3Malicious files are placed in SharePoint - they appear internal.
- 4Colleagues click and give up their passwords. The attacker gains broader access.
Email Security & Collaboration App Security
Stops phishing and malicious code in email, Teams, SharePoint, and OneDrive - before anyone can click.
Using your own tools against you.
Akira uses common IT tools that are already present in your environment. This makes them hard to detect.
Mapping the network
Common IT tools quietly map your network.
Jumping between systems
Windows tools move the attacker between servers.
Stealing passwords
Passwords are extracted from Active Directory.
How the attacker shuts down your protection.
- 02:14:03Defender disabled...
- 02:14:47EDR process killed...
- 02:15:12Vulnerable driver loaded...
- 02:15:38Security logs cleared...
Alarms are off. The attacker works undisturbed for hours.
An alarm without anyone listening is worthless. What makes a difference is that the alarm cannot be turned off - and that someone actually responds.
"Akira affiliates have been observed disabling endpoint detection tooling within minutes of initial access, often during weekends and overnight hours."
The real weapon.
Everything that can be used to pressure you into paying.
Two invoices per attack: one to unlock files, one not to leak them.
Data is smuggled out via services you already trust. The firewall sees nothing unusual.
Stolen data is the real threat today. Backup saves operations - but not leaks. Once data is out, the GDPR clock starts ticking.
Calculate your GDPR finesThe goal: you should have no choice.
Akira destroys all your backups before encryption starts. You either pay - or lose everything.
Deleting shadow copies
Windows restore points are deleted.
Disabling backup servers
Local backup servers are attacked.
Encrypting everything
Ransomware is rolled out across systems.
Locked cloud backups
Separate from the network. Cannot be deleted - even by admin.
How to stop the attacker in the middle of the attack.
One console. One agent
A single console and one agent per computer. You see everything in one place.
Stopping processes
Immediately stop suspicious programs and unauthorized connections.
Isolating machines
Cut the attacker's connections and remove affected machines from the network - with one click.
Without a unified platform you're chasing the attacker blindly, across hundreds of computers, with different tools. When every second counts, scattered systems are the attacker's best friend.
From backup to operation in minutes.
Servers are started directly from cloud backup. Available in minutes - not days.
The difference between minutes and days of downtime.
That's why it works as a whole.
Each layer sends signals. The MDR team connects them and acts 24/7. Together, the attacker has nowhere to hide.
| Layer | Acronis product | Capacity | Phases covered |
|---|---|---|---|
| Endpoint | Acronis XDR | Detection, protection, behavioral telemetry | Phase 2, 3, 4, 5 |
| Operations & incident response | Acronis RMM | Remote management, patching, incident response | Phase 6 |
| Email & collaboration | Email & Collaboration Security | Stops phishing and malicious code in email and shared spaces | Phase 1 |
| Back in operation | Backup + Disaster Recovery | Cloud backup, fast startup, VPN from recovery environment | Phase 5, 7 |
| Monitoring | 24/7 MDR Integration | Alarm analysis and active 24/7 response | All phases |
Six things to take away.
Secure the entry point
Phishing is the most common entry. Email protection is non-negotiable.
Back in operation = reduced business impact
Attackers use your own tools. Only behavioral analysis exposes them.
Data theft is the real threat
Encryption is not the worst. Stolen data leads to GDPR fines and long-term reputational damage.
Calculate the finesKeep backups out of reach
What they can't reach, they can't destroy. Locked cloud backups are your last lifeline.
One agent. Full overview.
A unified platform gives your team the speed and overview needed to stop the attack.
Back in operation = business impact
Every hour of downtime costs money. The recovery environment keeps you going while you rebuild your environment in the background.
Run the same playbook our partners use at 03:14
Step-by-step incident response built on the battle-tested stack. Free PDF, no fluff.
Protect your customers with Gridheart × Acronis.
A battle-tested stack from the Nordic's Acronis distributor. Up and running in minutes - not months.
Do you want this stack in your business?
Gridheart works through selected resellers. We'll connect you with a partner that suits your industry and size.