216.73.217.22

Akira ransomware continues to evolve

· Published 22/10/2024 09:43 · Modified 22/10/2024 09:57

Export JSON

Essential information

Published
22/10/2024 09:43
Modified
22/10/2024 09:57
Tags
2024-10-22 CVE-2020-3259 CVE-2023-20263 CVE-2023-20269 CVE-2023-27532 CVE-2023-48788 CVE-2024-37085 CVE-2024-40711 CVE-2024-40766 akira chacha8 double-extortion esxi linux megazord ransomware rust vulnerability exploitation windows
Related entities
8 vulnerabilities (cve), 37 observables, 1 intrusion sets (apt), 16 techniques (mitre), 2 malware, 2 others

Description

has established itself as a prominent threat, constantly evolving its tactics. Initially employing , it shifted focus to data exfiltration in early 2024. The group developed a variant of their encryptor, moving away from C++. Recently, has returned to previous encryption methods combined with data theft. They exploit various vulnerabilities for initial access and lateral movement, targeting sectors like manufacturing and professional services. The now uses cipher for faster encryption. is likely to continue prioritizing high-impact CVEs and attacks against VMware and environments, adapting their techniques to maintain operational stability and effectiveness.

Related entities

Vulnerabilities, IOCs, intrusion sets, MITRE techniques and other entities referenced in this report.

Vulnerabilities (CVE) (8)

CVE-2024-40711 KEV
9.8 Critical

Veeam Backup and Replication contains a deserialization vulnerability allowing an unauthenticated user to perform remote code execution.

Attack vector
Network
Published
17/10/2024
Modified
21/12/2025
Awaiting Analysis
CVE-2024-40766 KEV
9.8 Critical

An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorized resource access and in …

Attack vector
Network
Published
09/09/2024
Modified
21/12/2025
Analyzed
CVE-2024-37085 KEV
6.8 Medium

VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an …

Attack vector
Network
Published
30/07/2024
Modified
27/05/2026
Awaiting Analysis
CVE-2023-27532 KEV
7.5 High

Veeam Backup & Replication Cloud Connect component contains a missing authentication for critical function vulnerability that allows an unauthenticated user operating within …

Attack vector
Network
Published
22/08/2023
Modified
27/05/2026
CVE-2023-48788 KEV
9.8 Critical

Fortinet FortiClient EMS contains a SQL injection vulnerability that allows an unauthenticated attacker to execute commands as SYSTEM via specifically crafted requests.

Attack vector
Network
Published
25/03/2024
Modified
21/12/2025
CVE-2023-20269 KEV
5.0 Medium

Cisco Adaptive Security Appliance and Firepower Threat Defense contain an unauthorized access vulnerability that could allow an unauthenticated, remote attacker to conduct …

Attack vector
Network
Published
13/09/2023
Modified
21/12/2025
CVE-2023-20263
4.7 Medium

A vulnerability in the web-based management interface of Cisco HyperFlex HX Data Platform could allow an unauthenticated, remote attacker to redirect a …

Attack vector
NETWORK
Published
06/09/2023
Modified
21/12/2025
CVE-2020-3259 KEV

Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an information disclosure vulnerability. An attacker could retrieve memory contents on …

Published
15/02/2024
Modified
21/12/2025

Observables (37)

  • e3fa93dad8fb8c3a6d9b35d02ce97c22035b409e0efc9f04372f4c1d6280a481
  • ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5
  • dfe6fddc67bdc93b9947430b966da2877fda094edf3e21e6f0ba98a84bc53198
  • c0c0b2306d31e8962973a22e50b18dfde852c6ddf99baf849e3384ed9f07a0d6
  • bcae978c17bcddc0bf6419ae978e3471197801c36f73cff2fc88cecbe3d88d1a
  • b55fbe9358dd4b5825ce459e84cd0823ecdf7b64550fe1af968306047b7de5c9
  • abba655df92e99a15ddcde1d196ff4393a13dbff293e45f5375a2f61c84a2c7b
  • a6b0847cf31ccc3f76538333498f8fef79d444a9d4ecfca0592861cf731ae6cb
  • a546ef13e8a71a8b5f0803075382eb0311d0d8dbae3f08bac0b2f4250af8add0
  • 9f393516edf6b8e011df6ee991758480c5b99a0efbfd68347786061f0e04426c
  • 95477703e789e6182096a09bc98853e0a70b680a4f19fa2bf86cbb9280e8ec5a
  • 8e9a33809b9062c5033928f82e8adacbef6cd7b40e73da9fcf13ec2493b4544c
  • 88da2b1cee373d5f11949c1ade22af0badf16591a871978a9e02f70480e547b2
  • 8816caf03438cd45d7559961bf36a26f26464bab7a6339ce655b7fbad68bb439
  • 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0
  • 68d5944d0419bd123add4e628c985f9cbe5362ee19597773baea565bff1a6f1a
  • 6005dcbe15d60293c556f05e98ed9a46d398a82e5ca4d00c91ebec68a209ea84
  • 566ef5484da0a93c87dd0cb0a950a7cff4ab013175289cd5fccf9dd7ea430739
  • 43c5a487329f5d6b4a6d02e2f8ef62744b850312c5cb87c0a414f3830767be72
  • 3805f299d33ef43d17a5a1040149f0e5e2d5db57ec6f03c5687ac23db1f77a30
  • 2f629395fdfa11e713ea8bf11d40f6f240acf2f5fcf9a2ac50b6f7fbc7521c83
  • 2c7aeac07ce7f03b74952e0e243bd52f2bfa60fadc92dd71a6a1fee2d14cdd77
  • 28cea00267fa30fb63e80a3c3b193bd9cd2a3d46dd9ae6cede5f932ac15c7e2e
  • 0ee1d284ed663073872012c7bde7fac5ca1121403f1a5d2d5411317df282796c
  • 988776358d0e45a4907dc1f4906a916f1b3595a31fa44d8e04e563a32557eb42
  • 87b4020bcd3fad1f5711e6801ca269ef5852256eeaf350f4dde2dc46c576262d
  • 9585af44c3ff8fd921c713680b0c2b3bbc9d56add848ed62164f7c9b9f23d065
  • 7f731cc11f8e4d249142e99a44b9da7a48505ce32c4ee4881041beeddb3760be
  • 3298d203c2acb68c474e5fdad8379181890b4403d6491c523c13730129be3f75
  • 131da83b521f610819141d5c740313ce46578374abb22ef504a7593955a65f07
  • c9c94ac5e1991a7db42c7973e328fceeb6f163d9f644031bdfd4123c7b3898b0
  • 0c0e0f9b09b80d87ebc88e2870907b6cacb4cd7703584baf8f2be1fd9438696d
  • 678ec8734367c7547794a604cc65e74a0f42320d85a6dce20c214e3b4536bb33
  • 6cadab96185dbe6f3a7b95cf2f97d6ac395785607baa6ed7bf363deeb59cc360
  • 1b6af2fbbc636180dd7bae825486ccc45e42aefbb304d5f83fafca4d637c13cc
  • 3c92bfc71004340ebc00146ced294bc94f49f6a5e212016ac05e7d10fcb3312c
  • 5c62626731856fb5e669473b39ac3deb0052b32981863f8cf697ae01c80512e5

Intrusion sets (APT) (1)

  • akira GOLD SAHARAPUNK SPIDER
    The MITRE Corporation Confidence 100

    The Akira ransomware group is said to have emerged in March 2023, and there's much speculation about its ties to the former CONTI ransomware group.<br> <br> It's worth …

    First seen 01/01/1970 · Last seen 16/11/5138 Published 16/12/2025 19:39 · Modified 27/03/2026 01:13

Techniques (MITRE) (16)

Malware (2)

  • Megazord
    Family
    Published 03/12/2024 16:35 · Modified 03/12/2024 16:35
  • Akira
    Family
    Published 12/06/2026 16:57 · Modified 12/06/2026 16:57

Others (2)

  • Professional Services
  • Manufacturing

External references