Threat Assessment: Howling Scorpius (Akira Ransomware)
Summary: Howling Scorpius, the group behind Akira ransomware-as-a-service, has operated since March 2023 and has ranked among the top five most active ransomware groups in recent months, using double extortion to exfiltrate data before encryption. Unit 42 reports the group targets small to medium-sized businesses in North America, Europe and Australia across sectors including education, government, manufacturing and pharmaceuticals, and maintains encryptors for Windows, Linux and ESXi hosts, with the U.S. the most affected country per leak site data from March 2023 to October 2024.
Key Takeaway: Howling Scorpius patched the flaw Avast's June 2023 decryptor exploited within three days of public disclosure and has since added KCipher2 alongside ChaCha20, so a free decryptor is not a durable recovery plan against an adversary that updates this fast.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Ransomware
- Related
- Ransomware Defense Using the Wazuh Open Source Platform Cyber Risks ·