MITRE ATT&CKsoftware (malware)
S1129 Akira
- Domain
- enterprise
- Platforms
- Windows
- Version
- 2.0
- Created
- 2024-04-04
Description
Akira ransomware, written in C++, is most prominently (but not exclusively) associated with the ransomware-as-a-service entity Akira. Akira ransomware has been used in attacks across North America, Europe, and Australia, with a focus on critical infrastructure sectors including manufacturing, education, and IT services. Akira ransomware employs hybrid encryption and threading to increase the speed and efficiency of encryption and runtime arguments for tailored attacks. Notable variants include Rust-based Megazord for targeting Windows and Akira _v2 for targeting VMware ESXi servers.
Related
Uses · MITRE ATT&CK (10)
- T1059.001 PowerShell sub-technique
- T1059.003 Windows Command Shell sub-technique
- T1490 Inhibit System Recovery technique
- T1486 Data Encrypted for Impact technique
- T1135 Network Share Discovery technique
- T1047 Windows Management Instrumentation technique
- T1057 Process Discovery technique
- T1082 System Information Discovery technique
- T1083 File and Directory Discovery technique
- T1106 Native API technique
Referenced by MITRE ATT&CK · uses (1)
- G1024 Akira group
References
- https://www.cisa.gov/sites/default/files/2024-04/aa24-109a-stopransomware-akira-ransomware_2.pdf CISA Akira Ransomware APR 2024
- https://www.trellix.com/blogs/research/akira-ransomware/ Kersten Akira 2023
- https://blog.talosintelligence.com/akira-ransomware-continues-to-evolve/ Cisco Akira Ransomware OCT 2024