Ako Ransomware Exploits Windows APIs to Target Your System

Ako ransomware is a C++-based RaaS variant of MedusaLocker that surfaced in 2020; the report describes a multi-stage attack using RDP/email gateway exploits for initial access, ingress tool transfer and process injection for payload execution, lateral movement via PsExec and WMI, discovery via Windows API and network calls, and encryption of files with RSA and AES-256 after deleting volume shadow copies and disabling recovery mechanisms. The analysis outlines specific TTPs and recommends detection and prevention measures including endpoint behavior monitoring, command-line activity analysis for shadow copy deletion, privileged account hardening, and robust backup strategies.