Researchers Observe Sub-One-Hour Ransomware Attacks

Halcyon warns that the Akira ransomware group—suspected to include former Conti actors—completes full attack lifecycles in under four hours (sometimes under one), exploiting vulnerabilities in internet-facing VPN and backup appliances (e.g., SonicWall, Veeam, Cisco), using credential theft and IABs, exfiltrating data prior to encryption in a double-extortion model, and leveraging living-off-the-land tools; the report notes up to $244M in suspected proceeds and recommends layered defenses, detection of data staging/exfiltration, hardened third-party access, tested recovery, and dedicated anti-ransomware solutions.