Akira continues to cement its position as one of the most prevalent ransomware operations in the threat landscape, according to Cisco Talos’ findings and analysis.
Their success is partly due to the fact that they are constantly evolving. For example, after Akira already developed a new version of their ransomware encryptor earlier in the year, we just recently observed another novel iteration of the encryptor targeting Windows and Linux hosts alike.
Previously, Akria typically employed a double-extortion tactic in which critical data is exfiltrated prior to the compromised victim systems becoming encrypted. Beginning in early 2024, Akira appeared to be sidelining the encryption tactics, focusing on data exfiltration only. We assess with low to moderate confidence that this shift was due in part to the developers taking time to further retool their encryptor.
During this period, we began to see Akira ransomware-as-a-service (RaaS) operators developing a Rust variant of their ESXi encryptor, iteratively building on the payload’s functions while moving away from C++ and experimenting with different programming techniques.
Most recently, we have observed a potential shift back to previous encryption methods, in conjunction with data theft extortion tactics.
Returning to this approach leverages the reliability of tested encryption techniques, while simultaneously capitalizing on data theft for additional leverage. Pivoting to a previously effective strategy post-language reimplementation with v2 indicates a refocus on stability and efficiency in affiliate operations.
We anticipate Akira will continue refining its tactics, techniques, and procedures (TTPs), developing its attack chain, adapting to shifts in the threat landscape, and striving for greater effectiveness in its RaaS operations, targeting both Windows and Linux-based enterprise environments.
Members of our team will be de ..
Support the originator by clicking the read the rest link below.
