akira Ransomware

No MITRE ATT&CK MITRE ATT&CK

Perfil do grupo: Akira (G1024)

Ransomware catalogado como Akira (S1129)

The Akira ransomware group is said to have emerged in March 2023, and there's much speculation about its ties to the former CONTI ransomware group.

It's worth noting that with the end of CONTI's operation, several affiliates migrated to independent campaigns such as Royal, BlackBasta, and others.

According to some reports, Akira affiliates also work with other ransomware operations, such as Snatch and BlackByte, as an open directory of tools used by an Akira operator was identified, which also had connections to the Snatch ransomware.

The first version of the Akira ransomware was written in C++ and appended files with the '.akira' extension, creating a ransom note named 'akira_readme.txt,' partially based on the Conti V2 source code. However, on June 29, 2023, a decryptor for this version was reportedly released by Avast.

Subsequently, a version was released that fixed the decryption flaw on July 2, 2023. Since then, the new version is said to be written in Rust, this time called 'megazord.exe,' and it changes the extension to '.powerranges' for encrypted files.

Most of Akira's initial access vectors use brute-force attempts on Cisco VPN devices (which use single-factor authentication only).
Additionally, exploitation of CVEs: CVE-2019-6693 and CVE-2022-40684 for initial access has been identified.
Source: https://github.com/crocodyli/ThreatActors-TTPs

Vulnerabilidades citadas para este grupo

CVEs associadas ao grupo pelo ransomware.live. Fichas ainda não publicadas aparecem sem link.

• CVE-2023-20269 Crítica · 9.1 KEV Cisco Adaptive Security Appliance and Firepower Threat Defense Unauthorized Access Vulnerability
• CVE-2022-40684 Crítica · 9.8 KEV Fortinet Multiple Products Authentication Bypass Vulnerability
• CVE-2019-6693 Média · 6.5 KEV Fortinet FortiOS Use of Hard-Coded Credentials Vulnerability