Akira is a ransomware threat actor tied to WizardSpider/Conti, focusing on extortion by encrypting files and sometimes exfiltrating data. The analysis traces Akira’s evolution since 2022, detailing its ransomware behavior, multi-threaded file encryption, and connections with other gangs such as BlackByte, Lockbit, and Snatch. #Akira #WizardSpider #Conti #BlackByte #Lockbit #Snatch
Keypoints
- Akira is a ransomware threat actor active since 2022, with extortion as its main objective and a growing victim count.
- The group has used malware and vulnerability exploits, with phases aimed at detection evasion, lateral movement, and data exfiltration that evolve over time.
- Ransomware functionality centers on disk control, process management, multi-threading, and file encryption, accompanied by ransom note deployment.
- Akira maintains close ties to WizardSpider/Conti and has been observed collaborating or operating alongside BlackByte, Lockbit, and Snatch.
- The kill-chain-like behavior includes device information gathering, drive enumeration, ransom-note/extention handling, process monitoring, shadow copy deletion, and parallel encryption across multiple files.
- The actor relies on a broad set of utilities (e.g., Mimikatz, LaZagne, AnyDesk, Radmin, etc.) to facilitate intrusions and operations.
MITRE Techniques
- [T1059.001] PowerShell – Execution via PowerShell to run the Akira sample with parameters. Quote: “Process powershell.exe | cmd.exe > (Command) –encryption_path|-p|–share_file|-s|–localonly|-l|–encryption_percent|-n”
- [T1059.003] Windows Command Shell – Execution via Windows CMD to run the Akira sample with parameters. Quote: “(Process) powershell.exe | cmd.exe > (Command) …”
- [T1074] Log control creation by Akira – Creation of a control log by Akira. Quote: “(File-Write) [Ll]og-d{2}-d{2}-d{4}-d{2}-d{2}-d{2}.txt”
- [T1490] Delete shadows using WMI – Akira uses PowerShell to delete shadow copies via WMI. Quote: “(Process) powershell.exe > (Command) powershell.exe -Command “Get-WmiObject Win32_Shadowcopy | Remove-WmiObject””
- [T1486] Write readme file by Akira – Creation of the ransomware readme. Quote: “(File-Write) Akira_Readme.txt | help-you.txt”
- [T1136] Account creation prior to attack – Accounts are created for better management of targeted infrastructure prior to impacts. Quote: “(Process) cmd.exe > (Command) cmd.exes+/[qQ]s+/[cC]s+nets+users+/(dom|domain|add)s+d>.*d{1,3}.d{1,3}.d{1,3}.d{1,3}”
- [T1003] Dumping credentials via LSASS, SAM & NTDS – Credentials dumped to obtain more users. Quote: “(Command) cmd*/c*comsvcs.dll, MiniDump*lsass*full (Command) cmd*/c*-c -i*NTDS*-o* (Command) cmd*/c*-c -i*SYSTEM*-o* (Command) ntdsutil*ac i ntds*ifm*createfull*q q”
- [T1087] AD account discovery – Queries to map Active Directory infrastructure. Quote: “(Command) Get-ADComputer|Get-AdUser s+-Filter.*-Prop.*Select-Object.*”
- [T1562] Modify FW and disable defenses – Firewall rules added and real-time monitoring disabled. Quote: “(Command) netsh advfirewall firewall add rule name=*dir=*protocol=TCP*localport=*action=allow (Command) Set-MpPreference -DisableRealtimeMonitoring $true”
Indicators of Compromise
- [IP Address] context – 192.132.92.60, 148.72.168.13
- [Domain] context – jotuhup.com, zuvebeb.com
- [File name] context – Akira_Readme.txt, log-d01-d02-d04-d02.txt
- [Hash] context – 2CDA932F5A9DAFB0A328D0F9788BD89C, 64F8E1B825887AFE3130AF4BF4611C21
- [URL] context – http://repairdll.net/jHKIOEyC/
Read more: https://rexorvc0.com/2024/06/19/Akira-The-Old-New-Style-Crime/