akira

Profile

The Akira ransomware group is said to have emerged in March 2023, and there's much speculation about its ties to the former CONTI ransomware group.<br> <br> It's worth noting that with the end of CONTI's operation, several affiliates migrated to independent campaigns such as Royal, BlackBasta, and others.<br> <br> According to some reports, Akira affiliates also work with other ransomware operations, such as Snatch and BlackByte, as an open directory of tools used by an Akira operator was identified, which also had connections to the Snatch ransomware.<br> <br> The first version of the Akira ransomware was written in C++ and appended files with the '.akira' extension, creating a ransom note named 'akira_readme.txt,' partially based on the Conti V2 source code. However, on June 29, 2023, a decryptor for this version was reportedly released by Avast.<br> <br> Subsequently, a version was released that fixed the decryption flaw on July 2, 2023. Since then, the new version is said to be written in Rust, this time called 'megazord.exe,' and it changes the extension to '.powerranges' for encrypted files.<br> <br> Most of Akira's initial access vectors use brute-force attempts on Cisco VPN devices (which use single-factor authentication only).<br> Additionally, exploitation of CVEs: CVE-2019-6693 and CVE-2022-40684 for initial access has been identified.<BR>Source: https://github.com/crocodyli/ThreatActors-TTPs

Tactics and techniques (MITRE ATT&CK)

Initial Access

T1078 · Valid AccountsT1078.002 · Valid Accounts: Domain AccountsT1133 · External Remote ServicesT1190 · Exploit Public-Facing Application

Execution

T1047 · Windows Management InstrumentationT1059 · Command and Scripting InterpreterT1059.001 · Command and Scripting Interpreter: PowerShellT1059.002 · System Services: Service ExecutionT1059.003 · Command and Scripting Interpreter: Windows Command Shell

Persistence

T1136.001 · Create Account: Local AccountT1136.002 · Create Account: Domain Account

Privilege Escalation

T1078.002 · Valid Accounts: Domain AccountsTA0004 · Privilege Escalation

Stealth

T1027.001 · Obfuscated Files or Information: Binary PaddingT1036.005 · Masquerading: Match Legitimate Resource Name or Location

Defense Evasion

T1112 · Modify RegistryT1562.001 · Impair Defenses: Disable or Modify Tools

Credential Access

T1003.001 · OS Credential Dumping: LSASS MemoryT1558 · Steal or Forge Kerberos Tickets

Discovery

T1018 · Remote System DiscoveryT1082 · System Information DiscoveryT1482 · Domain Trust DiscoveryTA0007 · Discovery

Lateral Movement

T1021.001 · Remote Services: Remote Desktop ProtocolT1570 · Lateral Tool Transfer

Collection

T1213.002 · Data from Information Repositories: SharepointT1560.001 · Archive Collected Data: Archive via Utility

Exfiltration

T1048.003 · Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 ProtocolT1567.002 · Exfiltration Over Web Service: Exfiltration to Cloud Storage

Command and Control

T1219 · Remote Access ToolsT1229 · Remote Access Software

Impact

T1486 · Data Encrypted for ImpactT1490 · Inhibit System RecoveryT1531 · Account Access RemovalT1657 · Financial Theft

Defense Impairment

T1685 · Disable or Modify Tools