Akira

Akira is a ransomware operation that emerged in March 2023 and is widely tracked as a financially motivated cybercriminal threat actor. It is also referred to as Gold Sahara, Howling Scorpius, Punk Spider, and Storm-1567. Akira operates through an affiliate-driven intrusion model consistent with ransomware-as-a-service activity, with affiliates conducting compromises, data theft, and encryption against organizations worldwide, especially in North America. Akira is known for double extortion: operators steal data before encrypting systems and then threaten public release of the stolen information through a leak site if victims do not pay. Reported victim sectors include health care, financial services, manufacturing, education, real estate, consulting, agriculture, information technology, and professional services. The group has shown a strong concentration on U.S.-based organizations, with additional activity affecting the United Kingdom, Canada, Australia, Japan, and other countries. Observed initial access methods include exploitation of internet-facing appliances and services, especially VPN infrastructure, use of stolen credentials, password spraying and brute-force activity against remote access portals, and exploitation of known vulnerabilities including CVE-2023-20269 on Cisco ASA and FTD devices and CVE-2021-21972 on VMware vCenter. Akira has also been associated with targeting SSL VPN appliances and other exposed edge systems where patching or MFA was absent or weak. Post-compromise tradecraft includes extensive reconnaissance and Active Directory enumeration, use of legitimate administrative and remote access tools, creation of local and domain accounts for persistence, lateral movement over RDP and SMB administrative shares, and exfiltration with common file-transfer utilities. Reported tooling and techniques include PowerShell, WMI, Impacket, AdFind, WinRAR, WinSCP, FileZilla, RClone, AnyDesk, TeamViewer, OpenSSH, MobaXterm, RustDesk, network scanners, and Cloudflared tunneling. Akira operators have also disabled or degraded defenses, including Windows Defender and EDR products, deleted shadow copies, attempted to destroy backups, and in at least one case rebooted a host into Safe Mode with Networking to suppress endpoint protections before launching the encryptor. Akira has demonstrated notable hands-on-keyboard capability in virtualized environments. In one documented intrusion, operators compromised VMware infrastructure, created a new virtual machine, mounted copied virtual disks from a domain controller, extracted Active Directory database material and the SYSTEM hive, and used the recovered credential material to obtain highly privileged access before deploying ransomware. The group has also abused legacy backup software components and network shares to distribute payloads at scale. The Akira malware family is a 64-bit Windows ransomware written in C++ that appends a distinct extension to encrypted files, drops ransom notes, deletes shadow copies, and uses partial encryption for speed. It uses ChaCha for file encryption with RSA-protected key material and employs multithreading based on available processors. Akira also uses the Windows Restart Manager API to close processes and services that would otherwise lock files during encryption. Akira is best characterized as a financially motivated ransomware and extortion actor rather than a state-sponsored group. Reporting has also noted possible affiliate overlap or tradecraft sharing with other ransomware ecosystems, including Snatch, but such overlap does not change Akira’s core identity as a criminal extortion operation.