Akira Ransomware

The Akira ransomware variant typically gains initial access through exposed remote access tools, vulnerable VPN software, or by exploiting insecure multi-factor authentication and secure shell (SSH) configurations. Attackers also rely on malicious attachments, stolen credentials, and legitimate tools like Remote Desktop Protocol to gain access.

Once inside, Akira threat actors conduct lateral movement, disable security controls and endpoint detection, and perform privilege escalation to obtain administrative privileges. They may also target user accounts to maintain access and establish persistence.

They use various tactics techniques and procedures (also referred to as techniques and procedures TTPs) aligned with the mitre att ck framework to avoid detection and expand their presence in the network. Their encryption process is capable of targeting both Windows and Linux systems, including domain controllers, Active Directory, and remote services, for widespread impact.