Akira Ransomware Group Intensifies Attacks: New Escalation in Cybercrime Tactics

The Akira ransomware group, which was first detected in March 2023, has significantly ramped up its cyberattacks, marking a new level of sophistication and intensity in its operations. In mid-November 2024, the group set a disturbing record by posting over 30 victims in a single day on its data leak site. This escalation highlights the increasing threat posed by Akira, which has expanded its target range to sectors such as education, healthcare, manufacturing, finance, and critical infrastructure across North America, Europe, and Australia.

Akira Ransomware: A Growing Threat

Akira ransomware has evolved rapidly since its detection, employing an increasingly complex range of tactics, tools, and techniques to compromise organizations globally. Initially, the group’s primary method of entry involved exploiting compromised credentials from external authentication systems like VPNs. This allowed them to bypass security barriers and gain unauthorized access to networks.

Key to Akira’s success is its ability to leverage a variety of legitimate tools—commonly used for system administration and network testing—to perform reconnaissance and lateral movement once inside an organization’s network. These tools include popular programs like AnyDesk, RClone, and WinRAR, which are repurposed to facilitate remote access, persistence, and data exfiltration.

The ransomware itself has evolved from its original C++ variant, which encrypted files with the “.akira” extension, to a more sophisticated Rust-based variant known as “Megazord.” This new version, which surfaced in August 2023, is capable of targeting both Windows and VMware ESXi virtual environments, encrypting files with the “.powerranges” extension. The introduction of this more versatile encryptor has made the ransomware even more dangerous, as it now supports enhanced encryption routines, including a combination of ChaCha20 for speed and RSA for secure key exchange.

By early 2024, Akira had already compromised over 250 organizations, extracting more than $42 million in ransom payments. The group employs a double-extortion strategy, exfiltrating sensitive data before encrypting it and threatening to release this data on dedicated leak sites if the ransom is not paid. Akira’s leak site has become a crucial tool in its strategy, not only pressuring victims but also amplifying reputational and operational risks for organizations unwilling to comply with their demands.

Attack Techniques and Tools: A Closer Look

Akira’s technical approach revolves around exploiting a combination of public-facing vulnerabilities, credential dumping, and sophisticated malware payloads. The group frequently targets vulnerabilities in Cisco ASA and Firepower devices (notably CVE-2023-20269 and CVE-2020-3259), bypassing authentication protocols to infiltrate networks.

Once inside,

A notable characteristic of Akira’s operations is its ability to dynamically adapt its tactics, making it challenging for security teams to predict or counteract their attacks. This includes the use of techniques such as thread-spawning to evade detection and disrupt security monitoring efforts, as well as the deployment of customized payloads to target specific environments like VMware ESXi.

Multi-Variant Ransomware: Constant Evolution

The evolution of Akira’s ransomware payloads is one of the group’s most concerning features. From its initial C++ version, Akira has continuously adapted its encryption techniques and expanded its target capabilities. By incorporating both ChaCha20 and RSA encryption methods, the ransomware now combines speed and security, making it even harder for victims to recover their data without paying the ransom.

The group’s use of multiple ransomware variants—including the Megazord encryptor—shows a clear strategy of diversification, allowing them to tailor their attacks to different environments and increase their chances of success. Akira’s ability to evolve, along with its sophisticated evasion tactics, has made it one of the most dangerous and adaptable ransomware groups currently active.

Ransom Demands and Negotiations: Escalating Pressure

Akira’s extortion tactics are not limited to data encryption. The group employs a double-extortion model, in which it exfiltrates sensitive data before encrypting it. If the victim fails to pay the ransom, Akira threatens to release the stolen data on their public leak site, further increasing the pressure on the victim to comply.

Payments are exclusively demanded in Bitcoin, a method that provides the group with relative anonymity. Moreover, Akira’s operations are bolstered by its links to other cybercriminal groups, such as GOLD SAHARA and PUNK SPIDER, which assist with the rapid deployment of ransomware and the repurposing of legitimate tools for malicious purposes.

What Undercode Say:

Akira’s rise in prominence is not only a reflection of its technical prowess but also of the growing scale of ransomware operations in general. The group’s ability to compromise high-profile sectors like healthcare and critical infrastructure, combined with its sophisticated tactics and multiple attack vectors, positions it as a serious threat to organizations worldwide. This latest escalation—posting over 30 victims in a single day—highlights the sheer scale and audacity of the group’s operations.

What makes Akira particularly alarming is its adaptability. The group’s use of public penetration testing tools, alongside the deployment of multiple ransomware variants, gives it an edge in maintaining momentum and evading detection. Unlike earlier, more static ransomware families, Akira continuously evolves its payloads and attack strategies, keeping security teams on the defensive.

Akira’s combination of credential theft, exploitation of vulnerabilities, and data exfiltration means that organizations must prioritize securing their networks. Basic defense measures, such as patching vulnerabilities and using multi-factor authentication, are crucial but may not be enough on their own to stop a sophisticated group like Akira. As the ransomware continues to evolve, businesses must not only enhance their cybersecurity defenses but also ensure that they have up-to-date backups and recovery plans in place.

Finally, Akira’s involvement with other cybercrime groups like GOLD SAHARA and PUNK SPIDER shows that the group is part of a broader network of cybercriminals that work together to maximize the impact of their attacks. This collaborative approach, combined with Akira’s rapid deployment capabilities, makes it a formidable adversary in the global fight against ransomware.

Fact Checker Results:

Accuracy of Claims: The report on Akira ransomware’s tactics, including its use of compromised credentials, brute-forcing, and exploitation of vulnerabilities like CVE-2023-20269, aligns with findings from multiple cybersecurity sources.
Targeted Sectors: The mentioned sectors—education, finance, healthcare, and critical infrastructure—are consistent with other reports of ransomware targeting critical industries.
Ransom Payments: The $42 million in ransom payments reported by Akira is plausible, given the group’s extensive operations and the large number of victims listed on its leak site.