Threat Intelligence Report February 18 - February 24 2025

Akira Ransomware Group

Overview

Ransomware threats continue to evolve, and among the latest variants making a significant impact in the cybersecurity landscape is Akira ransomware. Emerging in early 2023, Akira has actively targeted businesses across multiple industries, employing sophisticated encryption techniques to lock critical files and extort victims for ransom payments. This analysis explores Akira ransomware in-depth, covering its origins, attack methodology, encryption strategies, indicators of compromise (IOCs), and best practices for mitigation.

Origins and Background

Akira ransomware was first detected in March 2023 and quickly gained attention due to its ability to infiltrate both Windows and Linux environments. Researchers believe Akira operates under a Ransomware-as-a-Service (RaaS) model, wherein affiliates distribute the malware and share ransom proceeds with its developers.

Notably, Akira's developers are suspected to have prior experience in ransomware operations, possibly linked to the now-defunct Conti group. This hypothesis is based on similarities in source code, encryption methodologies, and attack tactics observed between Akira and past Conti campaigns.

Detailed Tactics, Techniques, and Procedures (TTPs)

Akira ransomware employs a well-defined attack methodology, systematically compromising targeted systems through multiple stages, including initial access, privilege escalation, lateral movement, data exfiltration, and file encryption.

• System Services Execution (T1569, T1569.002): Akira leverages Windows Service Control Manager (services.exe) to maintain persistence and execute payloads.
• Privilege Escalation via Credential Dumping (T1003): Attackers use tools such as Mimikatz and PowerShell scripts to extract credentials.
• Remote Execution (T1021.002, T1078): Lateral movement is achieved via RDP, PsExec, and SSH (for Linux targets).

• System Information Discovery (T1082): Identifies machine configurations, domain details, and network topology.
• Registry Queries (T1012): Extracts system and user-specific configurations.
• Account Discovery (T1087): Harvests valid user credentials to escalate privileges.

• Remote Desktop Protocol (RDP) Exploitation (T1021.001): Used for moving across the network.
• Windows Admin Shares (T1021.002): Attackers leverage compromised admin credentials to gain access to shared resources.
• Scheduled Task/Job Execution (T1053.005): Persistence through scheduled tasks that execute the ransomware payload.

• Data Exfiltration (T1567.002): Utilises tools like Rclone and WinSCP to steal sensitive data before encryption.
• File Encryption for Impact (T1486): Akira encrypts files using a custom encryption algorithm and renames files with the .akira extension.
• Ransom Note Deployment (T1566): A ransom note (akira_readme.txt) is dropped with payment instructions.
• Double Extortion Model (T1653): Stolen data is used as leverage to coerce victims into ransom payments.

Targeted File Extensions

Indicators of Compromise (IOCs)

Akira ransomware leaves distinct markers that security teams can monitor to detect and respond to infections.

• File Extensions and Ransom Note:
  • Encrypted files renamed with .akira extension.
  • Presence of akira_readme.txt in multiple directories.
• Command-and-Control (C2) Infrastructure:
  • Akira frequently changes its infrastructure, but known malicious IPs include:
    • 192.185.52.166
    • 185.141.63.120
  • Tor-based ransom payment and negotiation sites (updated on dark web monitoring platforms).

• Chat Server:

https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion/

Mitigation Strategies

Organisations can reduce their risk of Akira ransomware infections by implementing robust security measures:

• Enforce Multi-Factor Authentication (MFA) for VPN and RDP access.
• Regular Patching & Updates to software, firmware, and operating systems promptly.
• Disable unnecessary RDP access or enforce strict VPN controls with zero-trust policies.
• Implement Role-Based Access Control (RBAC) and limit administrative privileges.
• Deploy Advanced Endpoint Detection & Response (EDR) Solutions

Ransomware Victims Worldwide

A recent ransomware analysis highlights that the United States remains the most heavily impacted nation, accounting for a staggering 63.16% of global incidents, underscoring its ongoing vulnerability to ransomware threats. Following this, Canada reported 6.58% of attacks, reaffirming North America's status as a prime target.

Countries including Germany and the United Kingdom each accounted for 3.95% of incidents, reflecting notable exposure to ransomware attacks. Meanwhile, Sweden, France, and Taiwan each contributed 1.97%, further emphasising the widespread reach of these cyber threats.

A broader set of countries—including India, Australia, Netherlands, Malaysia, Spain, and Switzerland—each reported 1.32% of attacks, highlighting the diverse geographic footprint of ransomware activity. Additionally, nations such as the United Arab Emirates, Saudi Arabia, Singapore, Pakistan, Israel, Romania, Bulgaria, Bangladesh, Brazil, Finland, Nigeria, Colombia, Palau, and Ecuador each accounted for 0.66% of incidents, demonstrating the extensive global impact.

This analysis underscores the persistent and evolving nature of ransomware threats, with North America, Europe, and parts of Asia facing a significant portion of the impact. The findings emphasise the critical need for strengthened cybersecurity infrastructure, proactive defence strategies, and heightened vigilance across all sectors to mitigate the relentless rise of ransomware attacks worldwide.