Akira and Lynx ransomware gangs operate using a RaaS model with double extortion tactics, targeting mainly SMBs and MSPs through stolen credentials, VPN vulnerabilities, and sophisticated techniques. Akira is linked to Conti’s leaked code, while Lynx incorporates elements from LockBit and INC ransomware, using advanced methods to disable security, delete shadow copies, and exfiltrate data. #Akira #Lynx #Conti #LockBit #INC
Keypoints
- Akira ransomware surfaced in 2022 and rapidly increased attacks through 2024 and 2025, exploiting VPN vulnerabilities and stolen credentials.
- Lynx ransomware, first seen in mid-2024, shares code similarities with INC ransomware and targets private businesses with phishing and double extortion tactics.
- Both ransomware families disable security software, delete shadow copies, and clear event logs to evade detection and complicate recovery efforts.
- Akira uses legitimate tools for lateral movement and encrypts files with ChaCha20, while Lynx uses AES encryption with ECC-generated keys and advanced process termination methods.
- Akira and Lynx target MSPs and SMBs to maximize ransom payouts by exploiting access to multiple networks and valuable data.
- Lynx ransomware uniquely prints ransom notes on network printers and sets desktop wallpapers with ransom messages as part of its extortion tactics.
- Both groups implement double extortion by exfiltrating data before encryption and threatening victims with public data leaks.
MITRE Techniques
- [T1078] Valid Accounts – Used stolen/purchased admin credentials to gain access to machines and servers (“using stolen / purchased admin credentials to attempt to gain access to machines / servers”).
- [T1136] Create Account – Not explicitly mentioned but implied in user credential exploitation and lateral movement.
- [T1041] Exfiltration Over C2 Channel – Attackers exfiltrate victims’ files before encryption as part of double extortion (“Before encrypting files, Akira operators archived and exfiltrated victims files to their servers”).
- [T1105] Ingress Tool Transfer – Use of legitimate tools for remote exfiltration and encryption (“launch remote exfiltration and then encryption using legitimate tools that are often whitelisted”).
- [T1490] Inhibit System Recovery – Deletion of shadow copies and clearing event logs to avoid recovery (“delete shadow copies using WMI object,” “clear event logs”).
- [T1562] Impair Defenses – Disabling security software to avoid detection (“When successful, they would disable security software”).
- [T1055] Process Injection – Use of Restart Manager API to terminate processes locking files (“uses Restart Manager API to terminate processes during the encryption process”).
- [T1090] Proxy – Use of VPN vulnerabilities for initial access (“exploiting various vulnerabilities, including SonicWall Firewall CVE-2024-40766”).
- [T1110] Brute Force – Credential theft and reuse for accessing victims’ infrastructure (“stealing credentials, reconnaissance, privilege escalation”).
- [T1539] Data from Network Shared Drive – Encryption of network shares in victim environments (“accepts only drives with flags ‘DRIVE_REMOVABLE’, ‘DRIVE_FIXED’ and ‘DRIVE_REMOTE’ for encryption”).
- [T1543] Create or Modify System Process – Lynx terminates services and processes related to backups and databases to avoid file-sharing violations (“terminated services: sql, veeam, backup, exchange”).
- [T1588] Develop Capabilities – Use of ransomware builders and adapting leaked code (“Lynx has its own builder, supports Windows and Linux versions”).
Indicators of Compromise
- [File Hash] Akira ransomware sample SHA256 – 88da2b1cee373d5f11949c1ade22af0badf16591a871978a9e02f70480e547b2
- [File Hash] Lynx ransomware sample SHA256 – 571f5de9dd0d509ed7e5242b9b7473c2b2cbb36ba64d38b32122a0a337d6cf8b
- [Domain] Akira ransomware onion sites – akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion, akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion
- [Domain] Lynx ransomware data leak and admin panel onion URLs – lynxchatly4zludmhmi75jrwhycnoqvkxb4prohxmyzf4euf5gjxroad.onion/login, lynxblogxstgzsarfyk2pvhdv45igghb4zmthnzmsipzeoduruz3xwqd.onion, and multiple others
Read more: https://www.acronis.com/en-us/tru/posts/msps-a-top-target-for-akira-and-lynx-ransomware/