AdversaryGraph public intelligence page

This page is part of Threat Matrix, the public browser workspace for the main AdversaryGraph platform. Use it for ATT&CK pivots, actor and technique context, similarity leads, detection coverage review, and analyst-ready investigation paths.

Validation disclaimer: TTP overlap, actor similarity, generated summaries, and coverage findings are investigation leads, not attribution proof or operational validation without analyst review.

Main AdversaryGraph project Documentation Malware Analysis GitHub

G1024 · 11 ATT&CK techniques · 0 correlated reports

Akira

Aliases: GOLD SAHARA, PUNK SPIDER

Akira is a ransomware variant and ransomware deployment entity active since at least March 2023. Akira uses compromised credentials to access single-factor external access mechanisms such as VPNs for initial access, then various publicly-available tools and techniques for lateral movement. Akira operations are associated with "double extortion" ransomware activity, where data is exfiltrated from victim environments prior to encryption, with threats to publish files if a ransom is not paid. Technical analysis of Akira ransomware indicates multiple overlaps with and similarities to Conti malware.

Open interactive actor investigation

ATT&CK techniques

T1567.002
Exfiltration to Cloud StorageT1213.002
SharepointT1531
Account Access RemovalT1482
Domain Trust DiscoveryT1078
Valid AccountsT1018
Remote System DiscoveryT1657
Financial TheftT1486
Data Encrypted for ImpactT1133
External Remote ServicesT1219
Remote Access SoftwareT1560.001
Archive via Utility

Correlated CTI and IR reports

Continue the investigation

Interactive AdversaryGraph AdversaryGraph documentation CTI Analyst Field Manual Israel Threat Actors CTI Anomaly Detection Atlas Insider Threat Detection Guide 1200km Medium research