Post-compromise investigation of an Akira ransomware incident: attackers gained RDP access, disabled endpoint protection, dumped credentials (procdump -> lsass), deployed a GOST tunnel (C2: 64.227.4.134) and RClone for likely exfiltration, then executed Akira ransomware that removed shadow copies and encrypted shared 'Shares' folders; Huntress reconstructed activity from Registry, event logs and Akira logs and provides IOCs and mitigation guidance.