Phishing email delivered a ZIP-packed executable that the user manually launched from Downloads, deploying Akira ransomware on host Vergil. The malware dropped a ransom note and destroyed Volume Shadow Copies through a WMI-based PowerShell one-liner, removing local recovery. Variant was confirmed as Akira via ransom note submission and the embedded Tor negotiation site; host was isolated and escalated as a confirmed ransomware incident.