Akira’s quiet LSASS theft shows why ransomware evades detection

At a glance

What this is: Halcyon argues that Akira’s ransomware tradecraft now centres on quiet credential theft from LSASS memory, enabling lateral movement and staging before encryption begins.

Why it matters: IAM, PAM and endpoint teams need to treat credential harvesting and post-exploitation tunnelling as the real warning signs, because encryption is often the last step rather than the first.

By the numbers:

• AI has made ransomware 13x faster than most defenses can detect.

Context

Ransomware is increasingly a post-compromise operations problem, not just an encryption event. Attackers are using quiet credential harvesting, remote access tooling and exfiltration staging to create a gap between foothold and detonation that conventional alerting often misses.

In this case, the identity angle is direct: LSASS memory contains live credentials and Kerberos tickets, so compromise of a single endpoint can quickly become credential reuse, lateral movement and network-wide impersonation. That is why static vs dynamic secrets matters here, even though the trigger is ransomware rather than classic NHI sprawl.

Key questions

Q: What breaks when attackers can dump LSASS memory before ransomware starts?

A: When LSASS dumping succeeds, the attacker can steal live credentials and Kerberos tickets before encryption begins, which makes the endpoint a launch point for impersonation and lateral movement. The broken control is usually identity containment, because defenders are still watching for ransomware payloads instead of credential harvesting and staging activity.

Q: Why does quiet credential theft increase ransomware impact?

A: Quiet credential theft increases impact because it gives attackers reusable identity material without the noisy tools that many detections expect. Once they have credentials and tickets, they can stage remote access, move laterally and prepare encryption from a stronger position. The operational cost is a much shorter response window.

Q: What are the signs that ransomware actors are staging data before encryption?

A: Common signs include unusual outbound traffic, repeated failed logins from foreign IP ranges, then successful access with compromised credentials. Analysts should also look for registry changes that weaken recovery options and activity that suggests large data transfers before encryption begins. These indicators matter because staging is often the step that turns a breach into a double-extortion event.

Q: Should teams prioritise credential containment before blocking encryption attempts?

A: Yes. Credential containment usually comes first because encryption is often the final step in a longer intrusion. If you stop the identity abuse early, you reduce the attacker’s ability to move laterally, maintain access and return with a second attempt. That is a better control point than waiting for the payload.

Technical breakdown

Why LSASS memory remains such a high-value credential source

LSASS, the Local Security Authority Subsystem Service, stores authentication material in memory, including live credentials and Kerberos tickets. When an attacker dumps that memory, they can recover usable identity material without relying on noisy tools or repeated interactive queries. The value is not only the password equivalent, but the session context and ticket material that supports impersonation. In practical terms, LSASS compromise turns a single endpoint into an identity pivot point, especially where local admin rights, weak segmentation, or reused credentials exist. Attackers prefer memory dumping because it reduces on-host artefacts while increasing downstream reach. See the [[L6|API key management guide]]? Read the Ultimate Guide to NHIs: Static vs Dynamic Secrets.

Practical implication: protect high-value endpoints with memory-dump detection, privileged access reduction and credential isolation.

Why quiet exfiltration is harder to detect than classic ransomware tooling

Traditional ransomware detections often key off known binaries, suspicious command lines or obvious encryption behaviour. A volumetric memory dump followed by tunnelling and offline processing creates fewer on-host indicators and can look like legitimate system activity to coarse detection logic. This is why behavioural telemetry matters more than signature dependence. The relevant signal is not just that a process ran, but whether sensitive memory is leaving the host, whether a tunnel appears for staging, and whether that sequence aligns with privilege abuse. The attack can stay operationally invisible until the actor is already positioned for lateral movement and impact.

Practical implication: correlate memory access, tunnel creation and unusual outbound volume in the same detection path.

How credential theft becomes ransomware readiness

Ransomware crews increasingly build an identity advantage before they encrypt anything. They collect credentials, establish remote access, and position staging infrastructure so that impact can be triggered only after access is stable. That sequence matters because the real failure is not the final ransom demand, but the unnoticed period in which the attacker turns one compromise into many. In this model, credential access is the enabling step, lateral movement is the scaling step, and encryption is simply the visible outcome. Defenders need to understand the chain as one continuous operation rather than separate incidents. See the Ransomware Prevention Guide.

Practical implication: treat credential theft alerts as pre-ransomware signals and escalate them with lateral movement controls.

Threat narrative

Attacker objective: The objective is to gain reusable credentials, maintain covert access, and stage the environment so ransomware can be deployed with maximum reach and minimum detection.

1. Entry begins with endpoint compromise that gives the attacker a foothold inside the environment, even though the article focuses on what happens after that foothold is established.
2. Credential access occurs when the attacker dumps LSASS memory and extracts live credentials and Kerberos tickets, then stages remote access tooling and tunnels for offline use.
3. Escalation and lateral movement follow as the stolen identity material enables broader impersonation and network reach before defenders notice the operation.
4. Impact arrives when the attacker is already positioned for ransomware deployment, but in this case containment stopped execution before encryption and ransom demand.

Breaches seen in the wild

• Codefinger S3 ransomware 2025: Codefinger used victims' compromised AWS keys to re-encrypt S3 buckets with SSE-C, set 7-day deletion and demanded ransom for the key.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Credential theft is now the real ransomware precursor: Halcyon’s example shows that operators increasingly win the identity battle before they ever launch encryption. LSASS dumping matters because it converts an endpoint into a credential source, and that changes the defender’s job from spotting malware to spotting identity abuse. The practitioner takeaway is that ransomware detection has to start at credential access, not at file encryption.

Quiet exfiltration creates a detection gap that endpoint teams still underestimate: The article’s central lesson is that low-noise memory dumping and tunnel staging can bypass controls tuned for obvious attacker tooling. That means behavioural correlation, not single-event alerting, has to carry more weight in SOC triage. Practitioners should assume the attacker is trying to look like routine system activity until the environment is already primed for impact.

Ransomware resilience now depends on limiting the blast radius of privileged identity material: Once LSASS yields tickets and credentials, one host becomes a pivot into many. That is why service account hygiene, privileged session isolation and rapid revocation matter even in a ransomware story. The governance failure is not just weak endpoint defence, but persistence of reusable identity material after first compromise.

Halcyon’s DXP example reinforces a named concept: detection-response latency: the time between silent credential theft and meaningful containment is where modern ransomware operators create value. When alerts depend on noisy execution, defenders lose the window that matters most. The practical conclusion is to move control points earlier in the attack chain and shorten the time from credential exposure to containment.

Machine identity and human identity risks increasingly converge in the same attack chain: the article is about ransomware, but the mechanism is identity reuse, ticket abuse and lateral movement. That makes this a useful reminder that privileged human sessions, service credentials and endpoint memory exposure all feed the same operational risk. The practitioner conclusion is to govern identity material as an attack surface, not a static asset.

What this signals

Credential access is now the decisive ransomware control point: once attackers can turn one endpoint into a source of reusable identity material, the rest of the kill chain becomes much easier to stage. That shifts programme design toward earlier containment, not just faster recovery.

Detection-response latency is the governance problem this article exposes: the gap between silent credential theft and visible encryption is where modern ransomware wins. Organisations should measure whether their telemetry can surface that gap before lateral movement completes.

The operational lesson for practitioners is to treat privileged memory, remote access staging and credential reuse as one connected risk surface. If those signals are separated across tools or teams, the attacker benefits from the delay.

For practitioners

• Harden LSASS against memory dumping Restrict who can read or dump LSASS memory, limit local admin exposure and monitor for credential access patterns on high-value endpoints.
• Correlate tunnel creation with sensitive memory access Alert when unusual outbound tunnels appear soon after privileged memory access, especially if the host also shows staging for remote control tools.
• Reduce the reuse value of stolen tickets and credentials Shorten credential lifetimes where possible, segment privileged access and ensure stolen tickets do not remain useful across multiple systems.
• Treat pre-encryption activity as a containment trigger Escalate the moment you see credential theft, remote access staging or lateral movement preparation, even if no encryption has started yet.

Key takeaways

• The article frames ransomware as an identity abuse problem first, because LSASS dumping gives attackers reusable credentials and tickets before encryption starts.
• Halcyon says Akira-style tradecraft can stay quiet long enough to stage tunnels, remote access and lateral movement without triggering obvious alarms.
• The limiting control is earlier identity containment, especially around privileged memory, reusable tickets and the signals that appear before file encryption.

Related NHI Mgmt Group resources: Guide to the Secret Sprawl Challenge · Ultimate Guide to NHIs: Static vs Dynamic Secrets · API Key Management Guide · Ransomware Prevention Guide

Key terms

• LSASS Memory Dump: A snapshot of the Local Security Authority Subsystem Service process that may contain authentication material, including plaintext credentials. Attackers and defenders use dumps for very different purposes, but when unprotected they become a high-value source of reusable secrets that can be analysed offline on another system.
• Kerberos Ticket Theft: Kerberos ticket theft is the capture of live authentication tickets that can be replayed or reused without knowing the underlying password. It is especially dangerous in Windows environments because tickets can support stealthy access across systems and may remain useful until they expire or are revoked.
• Detection-Response Latency: The elapsed time between identifying a security issue and executing a bounded, auditable fix. In data security programmes, long latency means exposure persists after discovery, which undermines the value of detection and weakens compliance evidence.
• Privileged Identity: A privileged identity is an account or credential set that has elevated permissions to access sensitive systems, data, or administrative functions. In IAM and PAM, these identities are tightly controlled because misuse can change configurations, approve access, exfiltrate secrets, or disrupt operations across human and non-human environments.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security and secrets management. It is a practical way to connect identity controls to the broader security programmes your role depends on.