自动化接入 · API / MCP EN

组织档案 · G1024

Akira

Akira is a ransomware variant and ransomware deployment entity active since at least March 2023. Akira uses compromised credentials to access single-factor external access mechanisms such as VPNs for initial access, then various publicly-available tools and techniques for lateral movement. Akira operations are associated with "double extortion" ransomware activity, where data is exfiltrated from victim environments prior to encryption, with threats to publish files if a ransom is not paid. Technical analysis of Akira ransomware indicates variants capable of targeting Windows or VMWare ESXi hypervisors and multiple overlaps with Conti ransomware.

ATT&CK G1024 置信带 高 · 100 来源 src_mitre_attck_enterprise 状态 active
全部2024

Akira is a ransomware variant and ransomware deployment entity active since at least March 2023.1 Akira uses compromised credentials to access single-factor external access mechanisms such as VPNs for initial access, then various publicly-available tools and techniques for lateral movement.23 Akira operations are associated with "double extortion" ransomware activity, where data is exfiltrated from victim environments prior to encryption, with threats to publish files if a ransom is not paid. Technical analysis of Akira ransomware indicates variants capable of targeting Windows or VMWare ESXi hypervisors and multiple overlaps with Conti ransomware.456

  1. Arctic Wolf Akira 2023
  2. Arctic Wolf Akira 2023
  3. Secureworks GOLD SAHARA
  4. BushidoToken Akira 2023
  5. CISA Akira Ransomware APR 2024
  6. Cisco Akira Ransomware OCT 2024

断言与引用

每条断言来自写入方；provenance 是写入方声称，不是本目录的复核结论。有效期按引用年份读取。

predicateobject有效期置信证据
also_known_asAkira— → …100src_mitre_attck_enterprise
also_known_asGOLD SAHARA— → …100src_mitre_attck_enterprise
also_known_asPUNK SPIDER— → …100src_mitre_attck_enterprise
also_known_asHowling Scorpius— → …100src_mitre_attck_enterprise
uses_techniquetech_t1567.0022024 → …100src_mitre_attck_enterprise
uses_techniquetech_t1213.0022024 → …100src_mitre_attck_enterprise
uses_techniquetech_t15312024 → …100src_mitre_attck_enterprise
uses_techniquetech_t14822024 → …100src_mitre_attck_enterprise
uses_techniquetech_t1036.0052024 → …100src_mitre_attck_enterprise
uses_techniquetech_t10782024 → …100src_mitre_attck_enterprise
uses_techniquetech_t15582024 → …100src_mitre_attck_enterprise
uses_techniquetech_t10182024 → …100src_mitre_attck_enterprise
uses_techniquetech_t1021.0012024 → …100src_mitre_attck_enterprise
uses_techniquetech_t1059.0012024 → …100src_mitre_attck_enterprise
uses_techniquetech_t16572024 → …100src_mitre_attck_enterprise
uses_techniquetech_t14862024 → …100src_mitre_attck_enterprise
uses_techniquetech_t11332024 → …100src_mitre_attck_enterprise
uses_techniquetech_t1027.0012024 → …100src_mitre_attck_enterprise
uses_techniquetech_t16852024 → …100src_mitre_attck_enterprise
uses_techniquetech_t12192024 → …100src_mitre_attck_enterprise
uses_techniquetech_t1560.0012024 → …100src_mitre_attck_enterprise

技术使用

ATT&CK技术platforms
T1018Remote System Discovery—
T1021.001Remote Desktop Protocol—
T1027.001Binary Padding—
T1036.005Match Legitimate Resource Name or Location—
T1059.001PowerShell—
T1078Valid Accounts—
T1133External Remote Services—
T1213.002Sharepoint—
T1219Remote Access Tools—
T1482Domain Trust Discovery—
T1486Data Encrypted for Impact—
T1531Account Access Removal—
T1558Steal or Forge Kerberos Tickets—
T1560.001Archive via Utility—
T1567.002Exfiltration to Cloud Storage—
T1657Financial Theft—
T1685Disable or Modify Tools—

别名

Akira · GOLD SAHARA · Howling Scorpius · PUNK SPIDER

读取与复核

记录自动入库·未人工复核。置信度是写入方给出的 0–100 值，置信带按 ≥80 / 50–79 / <50 划为高 / 中 / 低；四条信任轴（合成、生命周期、置信带、佐证源数）分开呈现，不合并为单一信任分。

纠错