Threat Brief: Understanding Akira Ransomware
Essential information
- Published
- 04/10/2024 10:04
- Modified
- 04/10/2024 12:30
- Tags
- 2024-10-04 CVE-2019-6693 CVE-2021-21972 CVE-2022-40684 CVE-2023-20269 akira chacha encryption conti credential dumping defense evasion double-extortion lateral movement raas ransomware
- Related entities
- 4 vulnerabilities (cve), 3 observables, 1 intrusion sets (apt), 15 techniques (mitre), 1 malware, 8 others
Description
Akira is a prolific ransomware operating since March 2023, targeting multiple industries in North America, the UK, and Australia. It functions as Ransomware as a Service (RaaS) and employs double extortion tactics. Akira has connections to the disbanded Conti group, sharing code similarities and operator overlaps. The ransomware uses various techniques for initial access, including compromised credentials and vulnerability exploitation. It performs reconnaissance, lateral movement, and employs tools for credential dumping and defense evasion. Akira exfiltrates data before encryption and destroys system backups. The ransomware uses the ChaCha algorithm for file encryption and creates a log file of its execution. It accepts command-line arguments to define its behavior and uses Windows restart manager APIs to terminate processes.