Akira ransomware continues to evolve
Summary: Cisco Talos reports that Akira ransomware has released another new encryptor iteration targeting both Windows and Linux hosts, after earlier developing a Rust variant of its ESXi encryptor and briefly shifting to data-exfiltration-only extortion in early 2024. Talos assesses with moderate confidence that Akira is now returning to C++ encryptors and double-extortion tactics, with recent samples using the ChaCha8 stream cipher, the ".akira" extension, and an "akira_readme.txt" ransom note.
Bottom line: Akira affiliates have been exploiting CVE-2024-40766 in SonicWall SonicOS for initial access and have used compromised VPN credentials, then harvested Veeam backup credentials and dumped Kerberos credentials via PowerShell - and in a June 2024 attack on a Latin American airline, access through a vulnerable Veeam backup server via CVE-2023-27532 sharply cut the time needed to exfiltrate data.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Mentions
- CVE-2024-40766
- Related
- CVE-2024-40766: Sonic Wall SonicOS Improper Access Control Vulnerability Known Exploited Vulnerabilities · Sep 09, 2024