Procedure examples

Akira uses software such as Advanced IP Scanner and MASSCAN to identify remote hosts within victim networks.

Akira has used RDP for lateral movement.

Akira has used binary padding to obfuscate payloads.

Akira has used legitimate names and locations for files to evade defenses.

Akira has used PowerShell scripts for credential harvesting and privilege escalation.

Akira uses valid account information to remotely access victim networks, such as VPN credentials.

Akira uses compromised VPN accounts for initial access to victim networks.

Akira has accessed and downloaded information stored in SharePoint instances as part of data gathering and exfiltration activity.

Akira uses legitimate utilities such as AnyDesk and PuTTy for maintaining remote access to victim environments.

Akira uses the built-in Nltest utility or tools such as AdFind to enumerate Active Directory trusts in victim environments.

Akira encrypts files in victim environments as part of ransomware operations.

Akira deletes administrator accounts in victim networks prior to encryption.

Akira have used scripts to dump Kerberos authentication credentials.

Akira uses utilities such as WinRAR to archive data prior to exfiltration.

Akira will exfiltrate victim data using applications such as Rclone.

Akira engages in double-extortion ransomware, exfiltrating files then encrypting them, in order to prompt victims to pay a ransom.

Akira has disabled or modified security tools for defense evasion.