Cisco Akira Ransomware OCT 2024

Akira has used RDP for lateral movement.

Akira has used binary padding to obfuscate payloads.

Akira has used legitimate names and locations for files to evade defenses.

Akira has used PowerShell scripts for credential harvesting and privilege escalation.

Akira uses valid account information to remotely access victim networks, such as VPN credentials.

Akira _v2 can target specific files and folders for encryption.

Akira examines files prior to encryption to determine if they meet requirements for encryption and can be encrypted by the ransomware. These checks are performed through native Windows functions such as GetFileAttributesW.

Akira _v2 will fail to execute if the targeted `/vmfs/volumes/` path does not exist or is not defined.

Megazord can encrypt files on targeted Windows hosts leaving them with a ".powerranges" file extension.

The Akira _v2 encryptor targets the `/vmfs/volumes/` path by default and can use the rust-crypto 0.2.36 library crate for the encryption processes.

Akira can encrypt victim filesystems for financial extortion purposes including through the use of the ChaCha20 and ChaCha8 stream ciphers.

Akira _v2 can stop running virtual machines.

Akira have used scripts to dump Kerberos authentication credentials.

Akira _v2 can enumerate the trace, debug, error, info, and warning logs on targeted systems.

Akira has disabled or modified security tools for defense evasion.