Akira
Akira is a ransomware variant and ransomware deployment entity active since at least March 2023.[1] Akira uses compromised credentials to access single-factor external access mechanisms such as VPNs for initial access, then various publicly-available tools and techniques for lateral movement.[1][2] Akira operations are associated with "double extortion" ransomware activity, where data is exfiltrated from victim environments prior to encryption, with threats to publish files if a ransom is not paid. Technical analysis of Akira ransomware indicates multiple overlaps with and similarities to Conti malware.[3]
Associated Group Descriptions
Techniques Used
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Enterprise | T1531 | Account Access Removal |
Akira deletes administrator accounts in victim networks prior to encryption.[2] |
|
| Enterprise | T1560 | .001 | Archive Collected Data: Archive via Utility |
Akira uses utilities such as WinRAR to archive data prior to exfiltration.[2] |
| Enterprise | T1486 | Data Encrypted for Impact |
Akira encrypts files in victim environments as part of ransomware operations.[3] |
|
| Enterprise | T1213 | .002 | Data from Information Repositories: Sharepoint |
Akira has accessed and downloaded information stored in SharePoint instances as part of data gathering and exfiltration activity.[2] |
| Enterprise | T1482 | Domain Trust Discovery |
Akira uses the built-in Nltest utility or tools such as AdFind to enumerate Active Directory trusts in victim environments.[1] |
|
| Enterprise | T1567 | .002 | Exfiltration Over Web Service: Exfiltration to Cloud Storage |
Akira will exfiltrate victim data using applications such as Rclone.[2] |
| Enterprise | T1133 | External Remote Services |
Akira uses compromised VPN accounts for initial access to victim networks.[2] |
|
| Enterprise | T1657 | Financial Theft |
Akira engages in double-extortion ransomware, exfiltrating files then encrypting them, in order to prompt victims to pay a ransom.[3] |
|
| Enterprise | T1219 | Remote Access Software |
Akira uses legitimate utilities such as AnyDesk and PuTTy for maintaining remote access to victim environments.[2][1] |
|
| Enterprise | T1018 | Remote System Discovery |
Akira uses software such as Advanced IP Scanner and MASSCAN to identify remote hosts within victim networks.[1] |
|
| Enterprise | T1078 | Valid Accounts |
Akira uses valid account information to remotely access victim networks, such as VPN credentials.[2][1] |
|
Software
References
- Steven Campbell, Akshay Suthar, & Connor Belfiorre. (2023, July 26). Conti and Akira: Chained Together. Retrieved February 20, 2024.
- Secureworks. (n.d.). GOLD SAHARA. Retrieved February 20, 2024.
- Will Thomas. (2023, September 15). Tracking Adversaries: Akira, another descendent of Conti. Retrieved February 21, 2024.