Adversaries and Victims

Firstly,
the operators of Akira ransomware are financially motivated cybercriminals. They are in it for the money and have made a lot of it already
in 2023, how much exactly is not clear. But public media
reports state that between March and July 2023, the group has compromised at
least 63 victims, which is around four organizations hit by Akira
ransomware per week that we know about. From negotiations seen by BleepingComputer, the ransomware gang demands ransoms ranging from a $200,000 to millions of dollars.

The group performs the usual double extortion campaigns,
whereby the victim’s files and information are stolen and shared to their Tor data
leak site (DLS) if the ransom is not paid. Private cybersecurity vendors also
track the Akira operators as Punk Spider (CrowdStrike) and Gold Sahara
(Secureworks).

Alongside
being connected to Conti, the Akira operators are likely connected to other
ransomware operations too, such as Snatch and BlackByte. In an August 2023, researchers
found
an open directory of tools used by an Akira operator that were also likely being
used by a threat actor with connections to Snatch ransomware. In July 2023, media
reports shared that Yamaha’s Canadian music division was listed on the Akira
DLS, which was after they were listed on BlackByte’s DLS in June 2023. The connections
between Akira and other ransomware gangs highlight that those who deploy Akira are
likely affiliated with more than one ransomware crew, as Microsoft found is usually
the case among affiliates.

Akira’s
victims have been located around the world, but most that have appeared on their
Tor DLS have been from North America. Akira attacks have impacted a wide range
of industries, such as education, financial services, manufacturing, professional
services, and healthcare. Most of the victims have been small-to-medium
businesses (SMBs) with a few recognizable brand names, such as Yamaha.

Capabilities and Infrastructure

There have
been multiple versions of the Akira ransomware family and it has been deployed across
Windows
domains and Hyper-V
virtual infrastructure, as well as VMware
ESXi hypervisors with Linux
virtual machines (VMs). The first version of Akira was written in C++ and
appended files with the “.akira” extension and dropped a ransom note called “akira_readme.txt”
that is at least partially based on Conti’s V2 source code, according to malware
analysts at Avast who also released a decryptor for Akira on 29 June 2023.
However, a new version was shortly released that patched the decryption
flaw on 2 July 2023. Since then, in late August 2023, a new revamped version
of Akira appeared developed in
Rust. This time it was called “megazord.exe” and appended “.powerranges”
extension to encrypted files.

The most
common initial access vector the Akira operators have used appears to be via
brute-forcing Cisco VPN devices with single-factor authentication only. The
Akira operator that was also tied to Snatch was also found exploiting
Fortinet devices vulnerable to CVE-2019-6693
and CVE-2022-40684
for initial access. Incident responders have also said that they believe Akira
operators likely purchase
VPN credentials from cybercrime marketplaces fuelled by infostealer malware botnets
or from potentially from initial access brokers (IABs).

By
extracting tools and tradecraft from numerous threat reports
on Akira, the operators have been known to leverage the same arsenal of tools time and time again, but may substitute some depending on the environment. These can be broken down into the following
categories:

• External Reconnaissance:
  Masscan and ReconFTW
• Internal Enumeration:
  PCHunter64, Advanced IP Scanner, LANsweeper, SharpHound, AdFind, SoftPerfect NetScan,
  and Windows Nltest
• Credential
  Theft: Minidump, Mimikatz, LaZagne, and DonPAPI
• Persistence:
  RMM tools, such as AnyDesk, RustDesk, Radmin, and ScreenConnect,
  as well as disabling firewalls followed by enabling RDP, and PuTTy. The SystemBC crimeware RAT has also been used Akira.
• Defense
  Evasion: Disable EDR tools with Terminator.exe and ToolPow, as well as batch
  scripts for disabling LSA Protection and Windows Defender
• Lateral
  Movement: Impacket (wmiexec.py and atexec.py), RDP, and SSH
• Collection:
  Searching and downloading files from Microsoft SharePoint
• Exfiltration:
  Compression tools (7zip, WinRAR, etc) as well as Rclone, FileZilla, and WinSCP
• Command-and-control:
  Cloudflare Tunnel (Cloudflared), MobaXterm, and Ngrok
• Impact: Akira
  ransomware, usually launched via PsExec 

After the
ransomware has been deployed and the data is stolen, Akira begins the
negotiations. This includes requesting the victim to visit Akira’s Green MS-DOS
style Tor Negotiation site (akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id[.]onion)
via the ransom note. And if the victim refuses to pay the ransom, they are
listed on Akira’s DLS (akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad[.]onion).

Figure 1: Akira’s Negotiation Portal (left) and Data Leak Site (right)

Finally,
something to note about Akira’s DLS is that it does not actually host the stolen
data like another ransomware Tor DLSs. This gang has decided to use Magnet Links that
require Torrenting software to download and view stolen data. This is a trend that other ransomware groups have followed, such as CL0P following the MOVEit breaches earlier in 2023.

Figure 2: Victim post on Akira’s DLS with Magnet Links