G1024 · 11 ATT&CK techniques · 0 correlated reports

Akira

Aliases: GOLD SAHARA, PUNK SPIDER

Akira is a ransomware variant and ransomware deployment entity active since at least March 2023. Akira uses compromised credentials to access single-factor external access mechanisms such as VPNs for initial access, then various publicly-available tools and techniques for lateral movement. Akira operations are associated with "double extortion" ransomware activity, where data is exfiltrated from victim environments prior to encryption, with threats to publish files if a ransom is not paid. Technical analysis of Akira ransomware indicates multiple overlaps with and similarities to Conti malware.

Open interactive actor investigation

ATT&CK techniques

T1567.002
Exfiltration to Cloud StorageT1213.002
SharepointT1531
Account Access RemovalT1482
Domain Trust DiscoveryT1078
Valid AccountsT1018
Remote System DiscoveryT1657
Financial TheftT1486
Data Encrypted for ImpactT1133
External Remote ServicesT1219
Remote Access SoftwareT1560.001
Archive via Utility

Correlated CTI and IR reports

Continue the investigation

Interactive ThreatMapper ThreatMapper documentation CTI Analyst Field Manual Israel Threat Actors CTI Anomaly Detection Atlas ITDR Handbook 1200km Medium research