www.trendmicro.com Open in urlscan Pro
23.32.242.31  Public Scan

URL: https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-akira
Submission: On December 21 via api from DE — Scanned from DE

Form analysis 1 forms found in the DOM

<form class="main-menu-search" aria-label="Search Trend Micro" data-equally-id="equally_ai___VtTux">
  <div class="main-menu-search__field-wrapper" id="cludo-search-form">
    <table class="gsc-search-box">
      <tbody>
        <tr>
          <td class="gsc-input">
            <input type="text" class="gsc-input-field" name="search" title="search" placeholder="Search" autocomplete="off" aria-label="search">
          </td>
        </tr>
      </tbody>
    </table>
  </div>
</form>

Text Content

Business

search close

 * Solutions
   * By Challenge
       
     * By Challenge
         
       * By Challenge
         Learn more
         
     * Understand, Prioritize & Mitigate Risks
         
       * Understand, Prioritize & Mitigate Risks
         
         Improve your risk posture with attack surface management
         
         Learn more
         
     * Protect Cloud-Native Apps
         
       * Protect Cloud-Native Apps
         
         Security that enables business outcomes
         
         Learn more
         
     * Protect Your Hybrid World
         
       * Protect Your Hybrid, Multi-Cloud World
         
         Gain visibility and meet business needs with security
         
         Learn more
         
     * Securing Your Borderless Workforce
         
       * Securing Your Borderless Workforce
         
         Connect with confidence from anywhere, on any device
         
         Learn more
         
     * Eliminate Network Blind Spots
         
       * Eliminate Network Blind Spots
         
         Secure users and key operations throughout your environment
         
         Learn more
         
     * See More. Respond Faster.
         
       * See More. Respond Faster.
         
         Move faster than your adversaries with powerful purpose-built XDR,
         attack surface risk management, and zero trust capabilities
         
         Learn more
         
     * Extend Your Team
         
       * Extend Your Team. Respond to Threats Agilely
         
         Maximize effectiveness with proactive risk reduction and managed
         services
         
         Learn more
         
   * By Role
       
     * By Role
         
       * By Role
         Learn more
         
     * CISO
         
       * CISO
         
         Drive business value with measurable cybersecurity outcomes
         
         Learn more
         
     * SOC Manager
         
       * SOC Manager
         
         See more, act faster
         
         Learn more
         
     * Infrastructure Manager
         
       * Infrastructure Manager
         
         Evolve your security to mitigate threats quickly and effectively
         
         Learn more
         
     * Cloud Builder and Developer
         
       * Cloud Builder and Developer
         
         Ensure code runs only as intended
         
         Learn more
         
     * Cloud Security Ops
         
       * Cloud Security Ops
         
         Gain visibility and control with security designed for cloud
         environments
         
         Learn more
         
   * By Industry
       
     * By Industry
         
       * By Industry
         Learn more
         
     * Healthcare
         
       * Healthcare
         
         Protect patient data, devices, and networks while meeting regulations
         
         Learn more
         
     * Manufacturing
         
       * Manufacturing
         
         Protecting your factory environments – from traditional devices to
         state-of-the-art infrastructures
         
         Learn more
         
     * Oil & Gas
         
       * Oil & Gas
         
         ICS/OT Security for the oil and gas utility industry
         
         Learn more
         
     * Electric Utility
         
       * Electric Utility
         
         ICS/OT Security for the electric utility
         
         Learn more
         
     * Federal
         
       * Federal
         Learn more
         
     * Automotive
         
       * Automotive
         Learn more
         
     * 5G Networks
         
       * 5G Networks
         Learn more
         
 * Platform
   * Vision One Platform
       
     * Trend Vision One
       Our Unified Platform
       
       Bridge threat protection and cyber risk management
       
       Learn more
       
   * Attack Surface Management
       
     * Attack Surface Management
       
       Operationalize a zero trust strategy
       
       Learn more
       
   * XDR (Extended Detection & Response)
       
     * XDR (Extended Detection & Response)
       
       Stop adversaries faster with a broader perspective and better context to
       hunt, detect, investigate, and respond to threats from a single platform
       
       Learn more
       
   * Endpoint Security
       
     * Endpoint Security
         
       * Endpoint Security Overview
         
         Defend the endpoint through every stage of an attack
         
         Learn more
         
     * Workload Security
         
       * Workload Security
         
         Optimized prevention, detection, and response for endpoints, servers,
         and cloud workloads
         
         Learn more
         
     * Industrial Endpoint Security
         
       * Industrial Endpoint Security
         Learn more
         
   * Cloud Security
       
     * Cloud Security
         
       * Trend Cloud One
         Cloud Security Overview
         
         The most trusted cloud security platform for developers, security
         teams, and businesses
         
         Learn more
         
     * Cloud Security Posture Management
         
       * Cloud Security Posture Management
         
         Leverage complete visibility and rapid remediation
         
         Learn more
         
     * Container Security
         
       * Container Security
         
         Simplify security for your cloud-native applications with advanced
         container image scanning, policy-based admission control, and container
         runtime protection
         
         Learn more
         
     * File Storage Security
         
       * File Storage Security
         
         Security for cloud file/object storage services leveraging cloud-native
         application architectures
         
         Learn more
         
     * Network Security
         
       * Network Security
         
         Advanced cloud-native network security detection, protection, and cyber
         threat disruption for your single and multi-cloud environments.
         
         Learn more
         
     * Open Source Security
         
       * Open Source Security
         
         Visibility and monitoring of open source vulnerabilities for SecOps
         
         Learn more
         
     * Cloud Visibility
         
       * Cloud Visibility
         
         As your organization continues to move data and apps to the cloud and
         transform your IT infrastructure, mitigating risk without slowing down
         the business is critical.
         
         Learn more
         
   * Network Security
       
     * Network Security
         
       * Network Security Overview
         
         Expand the power of XDR with network detection and response
         
         Learn more
         
     * Network Intrusion Prevention (IPS)
         
       * Network Intrusion Prevention (IPS)
         
         Protect against known, unknown, and undisclosed vulnerabilities in your
         network
         
         Learn more
         
     * Breach Detection System (BDS)
         
       * Breach Detection System (BDS)
         
         Detect and respond to targeted attacks moving inbound, outbound, and
         laterally
         
         Learn more
         
     * Secure Service Edge (SSE)
         
       * Secure Service Edge (SSE)
         
         Redefine trust and secure digital transformation with continuous risk
         assessments
         
         Learn more
         
     * Industrial Network Security
         
       * Industrial Network Security
         Learn more
         
   * Email Security
       
     * Email Security
       
       Stop phishing, malware, ransomware, fraud, and targeted attacks from
       infiltrating your enterprise
       
       Learn more
       
   * Mobile Security
       
     * Mobile Security
       
       On-premises and cloud protection against malware, malicious applications,
       and other mobile threats
       
       Learn more
       
   * Threat Intelligence
       
     * Threat Intelligence
       
       Keep ahead of the latest threats and protect your critical data with
       ongoing threat prevention and analysis
       
       Learn more
       
   * Small & Midsized Business Security
       
     * Small & Midsized Business Security
       
       Stop threats with comprehensive, set-it-and-forget-it protection
       
       Learn more
       
   * All Products, Services and Trials
       
     * All Products, Services and Trials
       Learn more
       
 * Research
   * Research
       
     * Research
         
       * Research
         Learn more
         
     * About Our Research
         
       * About Our Research
         Learn more
         
     * Research, News, and Perspectives
         
       * Research, News, and Perspectives
         Learn more
         
     * Research and Analysis
         
       * Research and Analysis
         Learn more
         
     * Blog
         
       * Blog
         Learn more
         
     * Security News
         
       * Security News
         Learn more
         
     * Zero Day Initiatives (ZDI)
         
       * Zero Day Initiatives (ZDI)
         Learn more
         
 * Services
   * Our Services
       
     * Our Services
         
       * Our Services
         Learn more
         
     * Service Packages
         
       * Service Packages
         
         Augment security teams with 24/7/365 managed detection, response, and
         support
         
         Learn more
         
     * Managed XDR
         
       * Managed XDR
         
         Augment threat detection with expertly managed detection and response
         (MDR) for email, endpoints, servers, cloud workloads, and networks
         
         Learn more
         
     * Incident Response
         
       * Incident Response
         
         Our trusted experts are on call whether you're experiencing a breach or
         looking to proactively improve your IR plans
         
         Learn more
         
     * Support Services
         
       * Support Services
         Learn more
         
 * Partners
   * Channel Partners
       
     * Channel Partners
         
       * Channel Partner Overview
         
         Grow your business and protect your customers with the best-in-class
         complete, multilayered security
         
         Learn more
         
     * Managed Security Service Provider
         
       * Managed Security Service Provider
         
         Deliver modern security operations services with our industry-leading
         XDR
         
         Learn more
         
     * Managed Service Provider
         
       * Managed Service Provider
         
         Partner with a leading expert in cybersecurity, leverage proven
         solutions designed for MSPs
         
         Learn more
         
     * Cloud Service Provider
         
       * Cloud Service Provider
         
         Add market-leading security to your cloud service offerings – no matter
         which platform you use
         
         Learn more
         
     * Professional Services
         
       * Professional Services
         
         Increase revenue with industry-leading security
         
         Learn more
         
     * Resellers
         
       * Resellers
         
         Discover the possibilities
         
         Learn more
         
     * Marketplace
         
       * Marketplace
         Learn more
         
     * System Integrators
         
       * System Integrators
         Learn more
         
   * Alliance Partners
       
     * Alliance Partners
         
       * Alliance Overview
         
         We work with the best to help you optimize performance and value
         
         Learn more
         
     * Technology Alliance Partners
         
       * Technology Alliance Partners
         Learn more
         
     * Our Alliance Partners
         
       * Our Alliance Partners
         Learn more
         
   * Partner Tools
       
     * Partner Tools
         
       * Partner Tools
         Learn more
         
     * Partner Login
         
       * Partner Login
         Login
         
     * Education and Certification
         
       * Education and Certification
         Learn more
         
     * Partner Successes
         
       * Partner Successes
         Learn more
         
     * Distributors
         
       * Distributors
         Learn more
         
     * Find a Partner
         
       * Find a Partner
         Learn more
         
 * Company
   * Why Trend Micro
       
     * Why Trend Micro
         
       * Why Trend Micro
         Learn more
         
     * The Trend Micro Difference
         
       * The Trend Micro Difference
         Learn more
         
     * Customer Success Stories
         
       * Customer Success Stories
         Learn more
         
     * The Human Connection
         
       * The Human Connection
         Learn more
         
     * Industry Accolades
         
       * Industry Accolades
         Learn more
         
     * Strategic Alliances
         
       * Strategic Alliances
         Learn more
         
   * About Us
       
     * About Us
         
       * About Us
         Learn more
         
     * Trust Center
         
       * Trust Center
         Learn more
         
     * History
         
       * History
         Learn more
         
     * Diversity, Equity and Inclusion
         
       * Diversity, Equity and Inclusion
         Learn more
         
     * Corporate Social Responsibility
         
       * Corporate Social Responsibility
         Learn more
         
     * Leadership
         
       * Leadership
         Learn more
         
     * Security Experts
         
       * Security Experts
         Learn more
         
     * Internet Safety and Cybersecurity Education
         
       * Internet Safety and Cybersecurity Education
         Learn more
         
     * Legal
         
       * Legal
         Learn more
         
     * Investors
         
       * Investors
         Learn more
         
   * Connect with Us
       
     * Connect with Us
         
       * Connect with Us
         Learn more
         
     * Newsroom
         
       * Newsroom
         Learn more
         
     * Events
         
       * Events
         Learn more
         
     * Careers
         
       * Careers
         Learn more
         
     * Webinars
         
       * Webinars
         Learn more
         

Back

Back

Back

Back

 * Free Trials
 * Contact Us

Looking for home solutions?
Under Attack?

Support
 * Business Support Portal
 * Virus and Threat Help
 * Renewals and Registration
 * Education and Certification
 * Contact Support
 * Find a Support Partner

Resources
 * Cyber Risk Index/Assessment
 * CISO Resource Center
 * DevOps Resource Center
 * What Is?
 * Threat Encyclopedia
 * Cloud Health Assessment
 * Cyber Insurance
 * Glossary of Terms
 * Webinars

Log In
 * Support
 * Partner Portal
 * Cloud One
 * Product Activation and Management
 * Referral Affililate

Back

arrow_back
search



close
 * Security News
 * Ransomware Spotlight
 * Ransomware Spotlight: Akira


RANSOMWARE SPOTLIGHT: AKIRA

X






Akira


October 05, 2023
 * Email
 * Facebook
 * Twitter
 * Google+
 * Linkedin



By Trend Micro Research

This report spotlights Akira, a novel ransomware family with highly experienced
and skilled operators at its helm.

View infographic of "Ransomware Spotlight: Akira"

Akira is swiftly becoming one of the fastest-growing ransomware families thanks
to its use of double extortion tactics, a ransomware-as-a-service (RaaS)
distribution model, and unique payment options.

Based on a report that analyzed blockchain and source code data, the Akira
ransomware group appears to be affiliated with the now-defunct Conti ransomware
gang. Conti, one of the most notorious ransomware families in recent history, is
believed to be the descendant of yet another prolific ransomware family, the
highly targeted Ryuk ransomware.

As ransomware actors evolve their tactics, create more sophisticated ransomware
families, and cause financial and reputational harm to businesses, organizations
need to work on improving their cybersecurity posture to effectively thwart
complex threats. This report spotlights Akira, a novel ransomware family with
highly experienced and skilled operators at its helm.


WHAT ORGANIZATIONS NEED TO KNOW ABOUT AKIRA

Akira ransomware emerged in March 2023 and has been known to target companies
based in the US and Canada.

Its Tor leak site has a unique retro look that, according to a report from
Sophos, is reminiscent of “1980s green-screen consoles” that can be navigated by
typing specific commands.

Based on its code, it is completely different from the Akira ransomware family
that was active in 2017, even though they both append encrypted files with the
same .akira extension.

As previously mentioned, Akira operators are associated with Conti ransomware
actors, which explains code similarities in both ransomware families. In July,
the Arctic Wolf Labs Team reported that Akira shared code similarities with the
Conti ransomware. However, they also noted that when Conti’s source code was
leaked, different malicious actors used it to create or tweak their own
ransomware code, which makes it even more challenging to trace back ransomware
families to Conti operators.

Based on our own analysis, Akira appears to be based on the Conti ransomware: It
shares similar routines with Conti, such as string obfuscation and file
encryption, and avoids the same file extensions that Conti avoids. We believe
that Akira operators’ main motivation for targeting organizations is financial
in nature.

The Akira RaaS group performs double extortion tactics and steals victims’
critical data prior to encrypting devices and files. Interestingly, according to
reports, Akira operators provide victims the option to pay for either file
decryption or data deletion; they don’t force victims into paying for both.
According to reports, ransom demands for Akira typically range from US$200,000
to over US$4 million.

On Sept. 12, 2023, the U.S. Department of Health and Human Services Health
Sector Cybersecurity Coordination Center (HC3) released a security bulletin
alerting the healthcare industry of Akira attacks.


RECENT ACTIVITIES

In June 2023, just three months after Akira was discovered, Akira expanded its
list of targeted systems to include Linux machines. Malware analyst rivitna
shared on X that Akira ransomware actors used a Linux encryptor and targeted
VMware ESXi virtual machines.

Meanwhile, in August, incident responder Aura reported that Akira was targeting
Cisco VPN accounts that didn’t have multifactor authentication (MFA).

Cisco released a security advisory on Sept. 6, 2023, stating that Akira
ransomware operators exploited CVE-2023-20269, a zero-day vulnerability in two
of their products’ remote access VPN feature: the Cisco Adaptive Security
Appliance (ASA) software and Cisco Firepower Thread Defense (FTD) software.

Cisco reported that malicious actors who exploit CVE-2023-20269 can identify
valid credentials that could be abused to establish unauthorized remote access
VPN sessions, and for victims running Cisco ASA Software Release 9.16 or
earlier, establish a clientless SSL VPN session.

Recently, Sentinel One released a video analyzing an Akira ransomware variant
named Megazord that emerged in August 2023. This variant appears to be
referencing a Power Rangers formation because it encrypts files with the
“POWERRANGES” file extension. The ransom note, which is named “powerranges.txt,”
instructs victims to contact the ransomware actor via TOX messenger.


TOP AFFECTED INDUSTRIES AND COUNTRIES

Because Akira is new and highly targeted, the number of attacks is not as
substantial as other more established and widely used ransomware families. Our
Trend Micro™ Smart Protection Network™ telemetry points to France as having been
most hit by Akira from May 1, 2023, to Aug. 31, 2023, with 53.1% of all
detections. The United States and Turkey take the second and third spots,
respectively, with 107 and 22 detections.

Figure 1. Countries with the highest number of attack attempts per machine for
the Akira ransomware (May 1, 2023, to Aug. 31, 2023)
Source: Trend Micro Smart Protection Network infrastructure




Based on our data, most of Akira’s victims belong to unspecified industries.
Based on reports, approximately 80% of Akira’s victims are small to medium-sized
businesses (SMBs). The materials, manufacturing, and financial sectors made the
top five list in the three-month span.

Figure 2. Industries with the highest number of attack attempts per machine for
the Akira ransomware (May 1, 2023, to Aug. 31, 2023)
Source: Trend Micro Smart Protection Network infrastructure




Akira’s monthly detections showed a surge in June 2023 with 508 attack attempts,
which is significantly higher than the other months in our analysis period. Our
lowest detections were for May 2023, with only three attack attempts for the
entire month.

Figure 3. Monthly breakdown of detections per machine for the Akira ransomware
(May 1, 2023, to Aug. 31, 2023)
Source: Trend Micro Smart Protection Network infrastructure


TARGETED REGIONS AND INDUSTRIES
ACCORDING TO AKIRA'S RANSOMWARE LEAK SITE

We now focus on Akira ransomware operators’ leak site data, which provides
details on organizations that have been targeted by Akira actors.

This data, which is a consolidation of Trend Micro’s open-source intelligence
(OSINT) research and investigation of the leak site, shows that Akira ransomware
actors compromised 107 organizations between April 1 to August 31, 2023. Most of
Akira victims — specifically, 85.9% of them — were businesses based in North
America.



Figure 4. The distribution by region of Akira ransomware’s victim organizations
Sources: Akira ransomware’s leak site and Trend Micro’s OSINT research (April
2023 – August 2023)

Figure 5. The 10 countries most targeted by the Akira ransomware group
Sources: Akira ransomware’s leak site and Trend Micro’s OSINT research (April
2023 – August 2023)




We’ve found that most of Akira’s victims were small-sized businesses, with 1 to
200 employees, at 59 victims. Meanwhile, midsized businesses and large
enterprises took the second and third slots, respectively. Interestingly, based
on leak site data, the most targeted sectors are the academe and professional
services, followed closely by construction and materials.



Figure 6. The distribution by organization size of Akira ransomware’s victim
organizations
Sources: Akira ransomware’s leak site and Trend Micro’s OSINT research (April
2023 – August 2023)

Figure 7. The 10 industries most targeted by Akira ransomware threat actors
Sources: Akira ransomware’s leak site and Trend Micro’s OSINT research (April
2023 – August 2023)


INFECTION CHAIN AND TECHNIQUES

The Akira ransomware typically gains access to victim environments by using
valid credentials that were possibly obtained from their affiliates or other
attacks. It has been observed using third-party tools such as PCHunter, AdFind,
PowerTool, Terminator, Advanced IP Scanner, Windows Remote Desktop Protocol
(RDP), AnyDesk, Radmin, WinRAR, and Cloudflare’s tunneling tool. Figure 8 shows
Akira’s infection chain.



Figure 8. The typical Akira ransomware infection chain



Figure 9. The Akira ransomware infection chain based on an infection case we’ve
analyzed




INITIAL ACCESS

Akira ransomware actors are known to use compromised VPN credentials to gain
initial access. They’ve also been observed targeting vulnerable Cisco VPNs by
exploiting CVE-2023-20269, a zero-day vulnerability that affects Cisco ASA and
FTD.




PERSISTENCE

Akira operators have been observed creating a new domain account on the
compromised system to establish persistence.




DEFENSE EVASION

For its defense evasion, Akira ransomware actors have been observed using
PowerTool or a KillAV tool that abuses the Zemana AntiMalware driver to
terminate AV-related processes.




DISCOVERY

The actors behind the Akira ransomware have been observed using the following to
gain knowledge on the victim's system and its connected network:

 * PCHunter and SharpHound to gather system information
 * AdFind alongside the net Windows command and nltest to obtain domain
   information
 * Advanced IP Scanner and MASSCAN to discover other remote systems




CREDENTIAL ACCESS

Akira ransomware operators use Mimikatz, LaZagne, or a specific command line to
gather credentials.




LATERAL MOVEMENT

Akira actors use Windows RDP to move laterally within the victim's network.




COMMAND AND CONTROL

Akira ransomware operators have been observed using the third-party tool and web
service RClone to exfiltrate stolen information. Moreover, they have also been
observed using either FileZilla or WinSCP to exfiltrate stolen information via
File Transfer Protocol (FTP).

 * AnyDesk
 * Radmin
 * Cloudflare Tunnel
 * MobaXterm
 * RustDesk
 * Ngrok




EXFILTRATION

Akira ransomware operators have been observed using the third-party tool and web
service RClone to exfiltrate stolen information. Moreover, they have also been
observed using either FileZilla or WinSCP to exfiltrate stolen information via
File Transfer Protocol (FTP).




IMPACT

Akira ransomware encrypts targeted systems using a hybrid encryption algorithm
that combines Chacha20 and RSA. Additionally, the Akira ransomware binary, like
most modern ransomware binaries, has a feature that allows it to inhibit system
recovery by deleting shadow copies from the affected system.




OTHER TECHNICAL DETAILS

 * It avoids encrypting the following directories:
    * winnt
    * tmp
    * temp
    * thumb
    * $Recycle.Bin
    * $RECYCLE.BIN
    * System Volume Information
    * Boot
    * Windows
    * Trend Micro
    * ProgramData

 * It avoids encrypting files with the following extensions:
    * .exe
    * .dll
    * .lnk
    * .sys
    * .msi
    * .akira

 * It encrypts the whole file, regardless of size, if the file extension is any
   of the following:
    * .4dd
    * .4dl
    * .accdb
    * .accdc
    * .accde
    * .accdr
    * .accdt
    * .accft
    * .adb
    * .ade
    * .adf
    * .adp
    * .arc
    * .ora
    * .alf
    * .ask
    * .btr
    * .bdf
    * .cat
    * .cdb
    * .ckp
    * .cma
    * .cpd
    * .dacpac
    * .dad
    * .dadiagrams
    * .daschema
    * .db
    * .db-shm
    * .db-wal
    * .db3
    * .dbc
    * .dbf
    * .dbs
    * .dbt
    * .dbv
    * .dbx
    * .dcb
    * .dct
    * .dcx
    * ddl
    * .dlis
    * .dp1
    * .dqy
    * .dsk
    * .dsn
    * .dtsx
    * .dxl
    * .eco
    * .ecx
    * .edb
    * .epim
    * .exb
    * .fcd
    * .fdb
    * .fic
    * .fmp
    * .fmp12
    * .fmpsl
    * .fol
    * .fol
    * .fp4
    * .fp5
    * .fp7
    * .fpt
    * .frm
    * .gdb
    * .grdb
    * .gwi
    * .hdb
    * .his
    * .ib
    * .idb
    * .ihx
    * .itdb
    * .itw
    * .jet
    * .jtx
    * .kdb
    * .kexi
    * .kexic
    * .kexis
    * .lgc
    * .lwx
    * .maf
    * .maq
    * .mar
    * .mas
    * .mav
    * .mdb
    * .mdf
    * .mpd
    * .mrg
    * .mud
    * .mwb
    * .myd
    * .ndf
    * .nnt
    * .nrmlib
    * .ns2
    * .ns3
    * .ns4
    * .nsf
    * .nv
    * .nv2
    * .nwdb
    * .nyf
    * .odb
    * .oqy
    * .orx
    * .owc
    * .p96
    * .p97
    * .pan
    * .pdb
    * .pdm
    * .pnz
    * .qry
    * .qvd
    * .rbf
    * .rctd
    * .rod
    * .rodx
    * .rpd
    * .rsd
    * .sas7bdat
    * .sbf
    * .scx
    * .sdb
    * .sdc
    * .sdf
    * .sis
    * .spq
    * .sql
    * .sqlite
    * .sqlite3
    * .sqlitedb
    * .te
    * .temx
    * .tmd
    * .tps
    * .trc
    * .trm
    * .udb
    * .udl
    * .usr
    * .v12
    * .vis
    * .vpd
    * .vvv
    * .wdb
    * .wmdb
    * .wrk
    * .xdb
    * .xld
    * .xmlff
    * .abcddb
    * .abs
    * .abx
    * .accdw
    * .adn
    * .db2
    * .fm5
    * .hjt
    * .icg
    * .icr
    * kdb
    * .lut
    * .maw
    * .mdn
    * .mdt

 * It avoids encrypting files with the following extensions:
    * .PLAY
    * .exe
    * .msi
    * .dll
    * .lnk
    * .sys

 * It drops a ransom note:
   
   
   
   akira_readme.txt

 * It encrypts files using Chacha20 and encrypts the key using RSA encryption.
    * Key generation:
      * A ChaCha20 key and nonce are generated using CryptGenRandom
    * Key encryption:
      * It uses the embedded RSA public key to encrypt the generated Chacha20
        key
    * File encryption
      * Files are encrypted using ChaCha20 encryption.
      * The Akira ransomware supports three encryption modes depending on the
        file type and size:
        * Full encryption
        * Partial encryption
        * Spot encryption

 * It appends this extension to encrypted files:
    * .akira

 * Hacktools
    * PowerTool
    * ADFind


MITRE TACTICS AND TECHNIQUES

Initial AccessPersistenceExecutionDefense EvasionCredential
AccessDiscoveryCommand and ControlLateral MovementExfiltrationImpact

T1078 - Valid Accounts
Uses compromised VPN credentialsl

T1190 - Exploit Public-Facing Application
Targets vulnerable Cisco devices via CVE-2023-20269

T1136.002 - Create Account: Domain Account
Once initial access is established, Akira operators will create a domain account
on the compromised system

T1059 - Command and Scripting Interpreters
Accepts parameters for its routines such as “-n 10” (for encryption percent) or
“-s {filename}” (for shared folder encryption)

T1562.001 - Impair Defenses: Disable or Modify Tools
It has been observed to use PowerTool or a KillAV tool that abuses Zemana
AntiMalware driver to terminate AV-related processes

T1003.001 - OS Credential Dumping: LSASS Memory
Uses Mimikatz, LaZagne, or a command line to dump LSASS from memory

T1082 - System Information Discovery
Uses PCHunter and SharpHound to gather system information

T1069.002 - Permission Groups Discovery: Domain Groups
Uses AdFind, net Windows command, and nltest to gather domain information

T1018 - Remote System Discovery
Uses Advanced IP Scanner and MASSCAN to discover remote systems

T1219 - Remote Access Software
May use either AnyDesk, Radmin, Cloudflare Tunnel, MobaXterm, RustDesk, or Ngrok
to gain remote access on targeted systems

T1570 - Lateral Tool Transfer
Uses RDP to move laterally within the victim’s network

T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage
Uses RClone to exfiltrate stolen information over web service

T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over
Unencrypted Non-C2 Protocol
Uses FileZilla or WinSCP to exfiltrate stolen information via FTP

T1490 - Inhibit System Recovery
Deletes shadow copies to inhibit recovery

T1486 - Data Encrypted for Impact
Akira ransomware is used to encrypt files


SUMMARY OF MALWARE, TOOLS, AND EXPLOITS USED

Initial AccessDefense EvasionDiscoveryCredential AccessCommand and
ControlLateral MovementExfiltration
 * VPN via compromised accounts

 * PowerTool

 * AdFind

 * Mimikatz

 * AnyDesk

 * RDP

 * WinSCP

 * CVE-2023-20269

 * KillAV (Terminator from GitHub)

 * PCHunter

 * LaZagne

 * Radmin

 * Rclone

 * Advanced IP Scanner

 * LSASS dump

 * Cloudflare Tunnel

 * FileZilla

 * SharpHound

 * MobaXterm

 * MASSCAN

 * RustDesk

 * ngrok





SECURITY RECOMMENDATIONS

<

As experienced ransomware actors develop increasingly sophisticated ransomware
families, organizations need to proactively protect themselves from evolving
threats. As ransomware threats evolve and exploit vulnerabilities to target
businesses around the world, organizations need to improve their security
posture to avoid financial and reputational harm.

Here are some security best practices that can help organizations protect their
mission-critical data from ransomware attacks:




AUDIT AND INVENTORY

 * Take an inventory of assets and data.
 * Identify authorized and unauthorized devices and software.
 * Make an audit of event and incident logs.




CONFIGURE AND MONITOR

 * Manage hardware and software configurations.
 * Grant admin privileges and access only when necessary to an employee’s role.
 * Monitor network ports, protocols, and services.
 * Activate security configurations on network infrastructure devices such as
   firewalls and routers.
 * Establish a software allowlist that executes only legitimate applications.




PATCH AND UPDATE

 * Conduct regular vulnerability assessments.
 * Perform patching or virtual patching for operating systems and applications.
 * Update software and applications to their latest versions.




PROTECT AND RECOVER

 * Implement data protection, backup, and recovery measures.
 * Enable multifactor authentication (MFA).




SECURE AND DEFEND

 * Employ sandbox analysis to block malicious emails.
 * Deploy the latest versions of security solutions to all layers of the system,
   including email, endpoint, web, and network.
 * Detect early signs of an attack such as the presence of suspicious tools in
   the system.
 * Use advanced detection technologies such as those powered by artificial
   intelligence (AI) and machine learning.




TRAIN AND TEST

 * Regularly train and assess employees in security skills.
 * Conduct red-team exercises and penetration tests.

A multilayered approach can help organizations guard possible entry points into
the system (endpoint, email, web, and network). Security solutions that can
detect malicious components and suspicious behavior can also help protect
enterprises.

 * Trend Micro Vision One™ provides multilayered protection and behavior
   detection, which helps block questionable behavior and tools early on before
   the ransomware can do irreversible damage to the system.
 * Trend Micro Cloud One™ Workload Security protects systems against both known
   and unknown threats that exploit vulnerabilities. This protection is made
   possible through techniques such as virtual patching and machine learning.
 * Trend Micro™ Deep Discovery™ Email Inspector employs custom sandboxing and
   advanced analysis techniques to effectively block malicious emails, including
   phishing emails that can serve as entry points for ransomware.
 * Trend Micro Apex One™ offers next-level automated threat detection and
   response against advanced concerns such as fileless threats and ransomware,
   ensuring the protection of endpoints.


INDICATORS OF COMPROMISE (IOCS)

The IOCs for this article can be found here. Actual indicators might vary per
attack.

HIDE

Like it? Add this infographic to your site:
1. Click on the box below.   2. Press Ctrl+A to select all.   3. Press Ctrl+C to
copy.   4. Paste the code into your page (Ctrl+V).

Image will appear the same size as you see above.

Posted in Ransomware Spotlight, Ransomware


RELATED POSTS

 * Trend Micro Security Predictions for 2024: Critical Scalability
 * Ransomware Spotlight: Trigona
 * LockBit, BlackCat, and Clop Prevail as Top RAAS Groups: Ransomware in 1H 2023
 * Stepping Ahead of Risk: Trend Micro 2023 Midyear Cybersecurity Threat Report
 * Ransomware Spotlight: Royal


RECENT POSTS

 * Threat Modeling API Gateways: A New Target for Threat Actors?
 * Rising Security Weaknesses in the Automotive Industry and What It Can Do on
   the Road Ahead
 * Trend Micro Security Predictions for 2024: Critical Scalability
 * Ransomware Spotlight: Trigona
 * Steering Clear of Security Blind Spots: What SOCs Need to Know


WE RECOMMEND

 * Internet of Things
 * Virtualization & Cloud
 * Ransomware
 * Securing Home Routers

 * MQTT and M2M: Do You Know Who Owns Your Machine’s Data?
    * Addressing CAPTCHA-Evading Phishing Threats With Behavior-Based AI
      Protection
    * A Deep Dive into the Packet Reflection Vulnerability Allowing Attackers to
      Plague Private 5G Networks

 * Understanding the Kubernetes Security Triad: Image Scanning, Admission
   Controllers, and Runtime Security
    * Mining Through Mountains of Information and Risk: Containers and Exposed
      Container Registries
    * Exposed Container Registries: A Potential Vector for Supply-Chain Attacks

 * Trend Micro Security Predictions for 2024: Critical Scalability
    * Ransomware Spotlight: Trigona
    * Ransomware Spotlight: Akira

 * Alexa and Google Home Devices can be Abused to Phish and Eavesdrop on Users,
   Research Finds
    * Mirai Variant Spotted Using Multiple Exploits, Targets Various Routers
    * A Look Into the Most Noteworthy Home Network Security Threats of 2017

CRITICAL SCALABILITY: TREND MICRO SECURITY PREDICTIONS FOR 2024

2024 is poised to be a hotbed for new challenges in cybersecurity as the
economic and political terrains continue to undergo digitization and enterprises
increasingly leverage artificial intelligence and machine learning (AI/ML), the
cloud, and Web3 technologies.
View the 2024 Trend Micro Security Predictions

TREND MICRO 2023 MIDYEAR CYBERSECURITY THREAT REPORT

We look at the major events in the first half of 2023 and draw a picture of the
threat landscape from behaviors and patterns observed in the threat landscape to
stay ahead and prepare for risks in the second half of the year.
View the report

Try our services free for 30 days

 * Start your free trial today

 * 
 * 
 * 
 * 
 * 


RESOURCES

 * Blog
 * Newsroom
 * Threat Reports
 * DevOps Resource Center
 * CISO Resource Center
 * Find a Partner


SUPPORT

 * Business Support Portal
 * Contact Us
 * Downloads
 * Free Trials
 * 
 * 


ABOUT TREND

 * About Us
 * Careers
 * Locations
 * Upcoming Events
 * Trust Center
 * 

Select a country / region

United States ❯

THE AMERICAS

 * United States
 * Brasil
 * Canada
 * México

MIDDLE EAST & AFRICA

 * South Africa
 * Middle East and North Africa

EUROPE

 * België (Belgium)
 * Česká Republika
 * Danmark
 * Deutschland, Österreich Schweiz
 * España
 * France
 * Ireland
 * Italia
 * Nederland
 * Norge (Norway)
 * Polska (Poland)
 * Suomi (Finland)
 * Sverige (Sweden)
 * Türkiye (Turkey)
 * United Kingdom

ASIA & PACIFIC

 * Australia
 * Центральная Азия (Central Asia)
 * Hong Kong (English)
 * 香港 (中文) (Hong Kong)
 * भारत गणराज्य (India)
 * Indonesia
 * 日本 (Japan)
 * 대한민국 (South Korea)
 * Malaysia
 * Монголия (Mongolia) and рузия (Georgia)
 * New Zealand
 * Philippines
 * Singapore
 * 台灣 (Taiwan)
 * ประเทศไทย (Thailand)
 * Việt Nam

Privacy | Legal | Accessibility | Site map

Copyright ©2023 Trend Micro Incorporated. All rights reserved


word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word

mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1