In the fast-paced world of cybersecurity, new threats and adversaries emerge regularly, challenging the resilience of organizations across the globe. One such formidable adversary that has garnered attention in early 2023 is the Akira ransomware. Known for its targeted attacks on small to medium-sized businesses spanning diverse sectors, including government, manufacturing, technology, education, consulting, pharmaceuticals, and telecommunications, Akira has become synonymous with adaptability and sophistication.
Evolution of Akira Tactics
Initially recognized for its encryption-based ransomware attacks, Akira has recently made a strategic shift towards extortion-only operations. This transformation involves exfiltrating sensitive data without deploying ransomware, a tactic that allows the threat actors to exploit organizations without encrypting their systems. This adaptability showcases Akira’s ability to stay ahead of cybersecurity defenses, making it a truly dynamic and elusive adversary.
The Akira Attack Chain
Akira’s attack chain is a masterclass in cyber intrusion, showcasing a level of sophistication that sets it apart in the threat landscape. The ransomware gains initial access through unauthorized VPN logins, exploiting vulnerabilities such as the absence of multi-factor authentication (MFA) or known weaknesses in VPN software. Once inside, Akira actors employ various techniques to obtain credentials, with a specific focus on Cisco VPN products.
The group demonstrates proficiency in credential access through advanced methods, including minidumping the LSASS process memory and leveraging tools to acquire credentials from the Active Directory database. Techniques such as copying the SYSTEM registry hive and NTDS.dit file highlight Akira’s commitment to achieving full domain credential compromise.
Evasion and Persistence
Akira’s ability to evade detection is evident in its consistent efforts to disable endpoint protections and Windows Defender real-time monitoring. The use of tools like runas for running commands as different users further complicates tracking efforts for defenders. The ransomware group excels in lateral movement within networks, frequently utilizing Remote Desktop Protocol (RDP) with valid administrator accounts and employing SMB and various tools to navigate through network structures.
For command-and-control operations, Akira actors prefer dual-use agents like AnyDesk to establish persistent remote access. This strategic choice allows them to blend in with legitimate network traffic, creating additional challenges for detection and mitigation.
Data Exfiltration as the Primary Goal
While initially known for encrypting systems, Akira’s primary focus has shifted towards data exfiltration. The group employs a variety of tools to exfiltrate sensitive information, showcasing adaptability based on the target’s network and defenses. Although the ransomware binary is still deployed under various names to encrypt machines within target networks, there is a growing trend of focusing on exfiltration without encryption, suggesting a calculated and strategic shift in the group’s objectives.
The Challenge and the Way Forward
The Akira ransomware group exemplifies the evolving nature of cyber threats. Its ability to adapt tactics, transitioning from encryption-based ransomware to data exfiltration and extortion, underscores the need for robust cybersecurity measures. With a relentless focus on credential access and defense evasion, Akira continues to pose a significant challenge in the cybersecurity landscape.
As organizations navigate the ever-changing threat landscape, it is crucial to stay vigilant, implement multi-layered security measures, and continually update cybersecurity protocols. The rise of Akira serves as a stark reminder that threat actors will stop at nothing to exploit vulnerabilities, making it imperative for businesses to invest in proactive cybersecurity strategies and stay one step ahead of the evolving threat landscape.
