Akira
Akira is a ransomware variant and ransomware deployment entity active since at least March 2023.[1] Akira uses compromised credentials to access single-factor external access mechanisms such as VPNs for initial access, then various publicly-available tools and techniques for lateral movement.[1][2] Akira operations are associated with "double extortion" ransomware activity, where data is exfiltrated from victim environments prior to encryption, with threats to publish files if a ransom is not paid. Technical analysis of Akira ransomware indicates multiple overlaps with and similarities to Conti malware.[3]
Associated Group Descriptions
Techniques Used
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Enterprise | T1213 | .002 | 从信息存储库获取数据: Sharepoint |
Akira has accessed and downloaded information stored in SharePoint instances as part of data gathering and exfiltration activity.[2] |
| Enterprise | T1482 | 域信任发现 |
Akira uses the built-in Nltest utility or tools such as AdFind to enumerate Active Directory trusts in victim environments.[1] |
|
| Enterprise | T1133 | 外部远程服务 |
Akira uses compromised VPN accounts for initial access to victim networks.[2] |
|
| Enterprise | T1560 | .001 | 归档收集数据: Archive via Utility |
Akira uses utilities such as WinRAR to archive data prior to exfiltration.[2] |
| Enterprise | T1486 | 数据加密以实现影响 |
Akira encrypts files in victim environments as part of ransomware operations.[3] |
|
| Enterprise | T1078 | 有效账户 |
Akira uses valid account information to remotely access victim networks, such as VPN credentials.[2][1] |
|
| Enterprise | T1657 | 财务窃取 |
Akira engages in double-extortion ransomware, exfiltrating files then encrypting them, in order to prompt victims to pay a ransom.[3] |
|
| Enterprise | T1531 | 账号访问移除 |
Akira deletes administrator accounts in victim networks prior to encryption.[2] |
|
| Enterprise | T1018 | 远程系统发现 |
Akira uses software such as Advanced IP Scanner and MASSCAN to identify remote hosts within victim networks.[1] |
|
| Enterprise | T1219 | 远程访问软件 |
Akira uses legitimate utilities such as AnyDesk and PuTTy for maintaining remote access to victim environments.[2][1] |
|
| Enterprise | T1567 | .002 | 通过网络服务渗出: Exfiltration to Cloud Storage |
Akira will exfiltrate victim data using applications such as Rclone.[2] |
Software
References
- Steven Campbell, Akshay Suthar, & Connor Belfiorre. (2023, July 26). Conti and Akira: Chained Together. Retrieved February 20, 2024.
- Secureworks. (n.d.). GOLD SAHARA. Retrieved February 20, 2024.
- Will Thomas. (2023, September 15). Tracking Adversaries: Akira, another descendent of Conti. Retrieved February 21, 2024.