Akira Ransomware: Attack Trends & Defense | Qualys
Summary: Akira, a ransomware-as-a-service operation active since March 2023, has infected over 196 organizations according to its leak site, targeting North America, the UK, and Australia, and exfiltrating data before encryption for double extortion. Qualys's TRU analyzed a new in-the-wild sample that logs its execution, deletes shadow copies via a PowerShell WMI command, kills processes using Windows restart manager APIs, and encrypts files with the ChaCha algorithm, with code and wallet overlaps tying it to the Conti group that shut down in May 2022.
Bottom line: Akira affiliates destroy system backups before encrypting and leak stolen data on a TOR site when victims don't pay, so recovery depends on defenses that catch the malware before that stage - and the Conti lineage means its playbook is already proven against hundreds of organizations.
Read the original at Qualys Blog ↗
- Topics
- Ransomware
- Related
- How adversaries use politics for compromise Cyber Risks ·Wasted Locker Goes "Big-Game Hunting" in 2020 Cyber Risks ·