Threat actor · G1024

Akira

GOLD SAHARAPUNK SPIDERHowling Scorpius

UnattributedNo public state or group attribution on record

Akira is a ransomware variant and ransomware deployment entity active since at least March 2023. Akira uses compromised credentials to access single-factor external access mechanisms such as VPNs for initial access, then various publicly-available tools and techniques for lateral movement.

MITRE ATT&CK Techniques

T1018 T1021.001 T1027.001 T1036.005 T1059.001 T1078 T1133 T1213.002 T1219 T1482 T1486 T1531 T1558 T1560.001 T1567.002 T1657 T1685

Associated Malware

AdFindAkiraAkira _v2LaZagneMegazordMimikatzPsExecRclone

Full MITRE ATT&CK profile

0 recent articles mention this actor

No recent coverage in the current feed. This actor may be quiet, or reporting hasn't used a matched alias.