Law-firm Akira ransomware: a Friday-night scenario walkthrough

This is a scenario walkthrough, not a client engagement summary. The narrative below is a composite drawn from patterns Obsidian Ridge sees across small litigation firms; no single client is described. The threat-actor techniques described — Akira ransomware affiliates using Pikabot delivery chains, LSASS credential dumping, and Cobalt Strike beacon lateral movement — are documented by Huntress threat-research advisories in 2024–2025, by the Coveware quarterly ransomware reports, and by CISA.

The setup

Assume a small mid-Atlantic litigation firm running iManage Work on-prem against a single SQL Server backend and Microsoft 365 Business Premium for mail and productivity. The firm has been running Obsidian Ridge's Protected tier for a few months, driven by two ordinary pressures for a firm of that shape: ABA Formal Opinion 483 expectations around breach response, and a cyber-insurance renewal market that had moved from soft to actively skeptical of firms without managed detection in place. That prior decision is what turns the rest of this walkthrough into a near-miss rather than a matter-file incident.

The delivery chain and the two hours nobody was watching

A junior associate downloads what she believes to be opposing counsel's exhibit list from a court e-filing link earlier that afternoon. The file is a malicious LNK that fetches a Pikabot loader. The loader dwells quietly for about two hours while the firm closes for the weekend. That dwell period is where an unmanaged environment loses this scenario before the encryptor even runs — a workstation-level EDR license nobody watches is not a security control at that point in the chain, it is a subscription.

What actually fires when the loader wakes up

The loader wakes up on Friday evening. It spawns a Cobalt Strike beacon, dumps LSASS credentials, and begins lateral SMB enumeration aimed at the iManage SQL server. Managed EDR fires three high-confidence detections within about ninety seconds: process injection into a signed Windows binary, credential-dumping access to LSASS, and outbound command-and-control traffic to a beacon address tied to a known Akira affiliate. Auto-isolation triggers on the associate's workstation approximately twenty-eight seconds after the first detection. The encryptor binary is staged on disk but does not execute — the process is killed before it can call the encryption routine. On the iManage server: no impact. The attacker never reaches it.

The response, in the order it has to happen

The SOC escalates to Obsidian Ridge's on-call analyst within minutes. Inside the next quarter hour:

• The associate's workstation is confirmed network-isolated at the host level.
• The associate's Microsoft 365 session is force-revoked across every device via Managed ITDR.
• Local admin credentials cached on the laptop are rotated; Active Directory is reviewed for new persistence mechanisms.
• The managing partner is on the phone with the analyst.
• Written notification is sent to the firm's cyber-insurance carrier well inside the twenty-four-hour window the policy typically requires.

Forensic review over the weekend — coordinated between the SOC, Obsidian Ridge, and the carrier's panel forensics firm — confirms the scope: the command-and-control channel was cut by isolation before any meaningful staging; the attacker did not reach the iManage server, the file share, or any other matter-data location; and the malicious LNK traces back to a court-filing-impersonation phishing email that cleared the firm's email gateway without a flag.

The outcome

No matter data lost. No client communications encrypted. No Formal Opinion 483 client-notification obligation triggered, because no material confidential information of any client was accessed. Court deadlines the following Monday proceed normally. The cyber-insurance renewal a few weeks later proceeds at standard rating with a positive carrier note about documented response speed. The malpractice insurer, notified per the cyber-rider clause, closes the file with no claim.

The controls that mattered, in order

1. Auto-isolation at the host level. Under a minute is faster than any human-in-the-loop response. The encryptor was on disk; what saved the firm was the process being killed before it could call the encryption routine.
2. Microsoft 365 session-token revocation. Without it, the attacker could have pivoted from the local credential dump straight into the tenant and started exfiltrating mail.
3. A segmentation decision made earlier. Not bridging the iManage server's network to the general user network meant that even if the workstation had encrypted, matter data would have been on the other side of that boundary.
4. A pre-existing relationship with a managed security operation. The managing partner did not have to make ten decisions in the first hour while panicked. The decisions had already been made and written down.
5. Documentation discipline. Every action is logged the way the carrier and, if it ever came to it, the bar would want to see.

What did NOT save the day

The email gateway did not save the day — the LNK bypassed it cleanly. The associate herself did not save the day; she did not recognize the phish. The SAT program had trained her to recognize wire-redirect themes but not court-filing impersonation. That gap gets closed afterward, which is the whole point of the training running as a cycle rather than an annual event. Domain admin password complexity did not save the day either — the LSASS dump captured cached credentials regardless of how long or complex the password was.

What a firm changes after seeing this pattern

• Court-filing-impersonation phishing simulations added to the SAT cycle for litigation paralegals and associates.
• Local Admin Password Solution (LAPS) so cached admin credentials cannot be reused across hosts.
• The iManage segmentation decision written explicitly into the firm's WISP — it was informal before.
• A quarterly tabletop involving the managing partner, the office manager, and outside ethics counsel.

Where to go from here

If your firm runs iManage, NetDocuments, or a comparable matter-data store and does not yet have a documented answer to "what happens if the encryptor fires on a Friday evening while the office is closing," start at the law-firm cybersecurity page or read The Briefing for the weekly write-ups of patterns like this. The mechanism generalizes across DMS platforms and firm sizes; the delivery vector rotates and the sequence stays roughly the same.