Automation · API / MCP 中文

Group profile · G1024

Akira

Akira is a ransomware variant and ransomware deployment entity active since at least March 2023. Akira uses compromised credentials to access single-factor external access mechanisms such as VPNs for initial access, then various publicly-available tools and techniques for lateral movement. Akira operations are associated with "double extortion" ransomware activity, where data is exfiltrated from victim environments prior to encryption, with threats to publish files if a ransom is not paid. Technical analysis of Akira ransomware indicates variants capable of targeting Windows or VMWare ESXi hypervisors and multiple overlaps with Conti ransomware.

ATT&CK G1024 Confidence High · 100 Source src_mitre_attck_enterprise Status active
All2024

Akira is a ransomware variant and ransomware deployment entity active since at least March 2023.1 Akira uses compromised credentials to access single-factor external access mechanisms such as VPNs for initial access, then various publicly-available tools and techniques for lateral movement.23 Akira operations are associated with "double extortion" ransomware activity, where data is exfiltrated from victim environments prior to encryption, with threats to publish files if a ransom is not paid. Technical analysis of Akira ransomware indicates variants capable of targeting Windows or VMWare ESXi hypervisors and multiple overlaps with Conti ransomware.456

  1. Arctic Wolf Akira 2023
  2. Arctic Wolf Akira 2023
  3. Secureworks GOLD SAHARA
  4. BushidoToken Akira 2023
  5. CISA Akira Ransomware APR 2024
  6. Cisco Akira Ransomware OCT 2024

Claims and citations

Every claim comes from a writer; provenance is the writer's assertion, not a review verdict from this directory. Validity reads by citation year.

predicateobjectValidConf.Evidence
also_known_asAkira— → …100src_mitre_attck_enterprise
also_known_asGOLD SAHARA— → …100src_mitre_attck_enterprise
also_known_asPUNK SPIDER— → …100src_mitre_attck_enterprise
also_known_asHowling Scorpius— → …100src_mitre_attck_enterprise
uses_techniquetech_t1567.0022024 → …100src_mitre_attck_enterprise
uses_techniquetech_t1213.0022024 → …100src_mitre_attck_enterprise
uses_techniquetech_t15312024 → …100src_mitre_attck_enterprise
uses_techniquetech_t14822024 → …100src_mitre_attck_enterprise
uses_techniquetech_t1036.0052024 → …100src_mitre_attck_enterprise
uses_techniquetech_t10782024 → …100src_mitre_attck_enterprise
uses_techniquetech_t15582024 → …100src_mitre_attck_enterprise
uses_techniquetech_t10182024 → …100src_mitre_attck_enterprise
uses_techniquetech_t1021.0012024 → …100src_mitre_attck_enterprise
uses_techniquetech_t1059.0012024 → …100src_mitre_attck_enterprise
uses_techniquetech_t16572024 → …100src_mitre_attck_enterprise
uses_techniquetech_t14862024 → …100src_mitre_attck_enterprise
uses_techniquetech_t11332024 → …100src_mitre_attck_enterprise
uses_techniquetech_t1027.0012024 → …100src_mitre_attck_enterprise
uses_techniquetech_t16852024 → …100src_mitre_attck_enterprise
uses_techniquetech_t12192024 → …100src_mitre_attck_enterprise
uses_techniquetech_t1560.0012024 → …100src_mitre_attck_enterprise

Technique use

ATT&CKTechniqueplatforms
T1018Remote System Discovery—
T1021.001Remote Desktop Protocol—
T1027.001Binary Padding—
T1036.005Match Legitimate Resource Name or Location—
T1059.001PowerShell—
T1078Valid Accounts—
T1133External Remote Services—
T1213.002Sharepoint—
T1219Remote Access Tools—
T1482Domain Trust Discovery—
T1486Data Encrypted for Impact—
T1531Account Access Removal—
T1558Steal or Forge Kerberos Tickets—
T1560.001Archive via Utility—
T1567.002Exfiltration to Cloud Storage—
T1657Financial Theft—
T1685Disable or Modify Tools—

Aliases

Akira · GOLD SAHARA · Howling Scorpius · PUNK SPIDER

Reading and review

Records are auto-ingested and not human-reviewed. Confidence is the writer's 0–100 value; bands split at ≥80 / 50–79 / <50 into high / medium / low. The four trust axes (synthetic, lifecycle, band, source count) stay separate and never merge into one score.

Corrections