# MA-1066.042024: MyCERT Advisory - Akira Ransomware

**Date:** 23 Apr 2024  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-1066.042024  
**Advisory ID:** MA-1066.042024

---

**1.0 Introduction**
Recently, the Cybersecurity and Infrastructure Security Agency (CISA), the United States Federal Bureau of Investigation (FBI), Europol’s European Cybercrime Centre (EC3), and the Netherlands’ Cyber Security Centre (NCSC-NL) have released a joint CSA. The purpose is to disseminate known Akira ransomware IOCs and TTPs identified through FBI investigations as recently as February 2024 and trusted third-party reporting, shared in this advisory.
**2.0 Impact**
Since March 2023, Akira ransomware has affected businesses and vital infrastructure entities primarily across North America, Europe, and Australia. Notably, by April 2023, after initially targeting Windows systems, the Akira threat actor introduced a Linux version aimed at VMware ESXi virtual machines. As of January 1, 2024, the ransomware group has attacked over 250 organisations, resulting in around $42 million USD in ransom payments.
**3.0 Technical Details3.1 Tactics, Techniques and Procedure (TTPs)3.1.1 Initial Access**
The FBI and cybersecurity researchers have observed Akira threat actors obtaining initial access to organisations through a virtual private network (VPN) service without multi-factor authentication (MFA) configured, mostly using known Cisco vulnerabilities [[T1190](https://attack.mitre.org/versions/v14/techniques/T1190/)] [CVE-2020-3259](https://nvd.nist.gov/vuln/detail/CVE-2020-3259) and [CVE-2023-20269](https://nvd.nist.gov/vuln/detail/CVE-2023-20269). Additional methods of initial access include the use of external-facing services such as Remote Desktop Protocol (RDP) [[T1133](https://attack.mitre.org/versions/v14/techniques/T1133/)], spear phishing [[T1566.001](https://attack.mitre.org/versions/v14/techniques/T1566/001/)][[T1566.002](https://attack.mitre.org/versions/v14/techniques/T1566/002/)], and the abuse of valid credentials[[T1078](https://attack.mitre.org/versions/v14/techniques/T1078/)].
**3.1.2 Persistence and Discovery**
Once initial access is obtained, Akira threat actors attempt to abuse the functions of domain controllers by creating new domain accounts [[T1136.002](https://attack.mitre.org/versions/v14/techniques/T1136/002/)] to establish persistence. In some instances, the FBI identified Akira threat actors creating an administrative account named itadm.
According to FBI and open source reporting, Akira threat actors leverage post-exploitation attack techniques, such as Kerberoasting, to extract credentials stored in the process memory of the Local Security Authority Subsystem Service (LSASS) [[T1003.001](https://attack.mitre.org/versions/v14/techniques/T1003/001/)]. Akira threat actors also use credential scraping tools [[T1003](https://attack.mitre.org/versions/v14/techniques/T1003/)] like Mimikatz and LaZagne to aid in privilege escalation. Tools like SoftPerfect and Advanced IP Scanner are often used for network device discovery (reconnaissance) purposes [[T1016](https://attack.mitre.org/versions/v14/techniques/T1016/)] and net Windows commands are used to identify domain controllers [[T1018](https://attack.mitre.org/versions/v14/techniques/T1018/)] and gather information on domain trust relationships [[T1482](https://attack.mitre.org/versions/v14/techniques/T1482)].
**3.1.3 Defense Evasion**
Based on trusted third-party investigations, Akira threat actors have been observed deploying two distinct ransomware variants against different system architectures within the same compromise event. This marks a shift from the multi-layeredrecently reported Akira ransomware activity. Akira threat actors were first observed deploying the Windows-specific “Megazord” ransomware, with further analysis revealing that a second payload was concurrently deployed in this attack (which was later identified as a novel variant of the Akira ESXi encryptor, “Akira\_v2”).
As Akira threat actors prepare for lateral movement, they commonly disable security software to avoid detection. Cybersecurity researchers have observed Akira threat actors using PowerTool to exploit the Zemana AntiMalware driver and terminate antivirus-
**3.1.4 Exfiltration and Impact**
Akira threat actors leverage tools such as FileZilla, WinRAR [[T1560.001](https://attack.mitre.org/versions/v14/techniques/T1560/001/)], WinSCP, and RClone to exfiltrate data [[T1048](https://attack.mitre.org/versions/v14/techniques/T1048/)]. To establish command and control channels, threat actors leverage readily available tools like AnyDesk, MobaXterm, RustDesk, Ngrok, and Cloudflare Tunnel, enabling exfiltration through various protocols such as File Transfer Protocol (FTP), Secure File Transfer Protocol (SFTP), and cloud storage services like Mega [[T1537](https://attack.mitre.org/versions/v14/techniques/T1537)] to connect to exfiltration servers.
Akira threat actors use a double-extortion model [[T1657](https://attack.mitre.org/versions/v14/techniques/T1657/)] and encrypt systems [[T1486](https://attack.mitre.org/versions/v14/techniques/T1486/)] after exfiltrating data. The Akira ransom note provides each company with a unique code and instructions to contact the threat actors via a .onion URL. Akira threat actors do not leave an initial ransom demand or payment instructions on compromised networks, and do not relay this information until contacted by the victim. Ransom payments are paid in Bitcoin to cryptocurrency wallet addresses provided by the threat actors. To further apply pressure, Akira threat actors threaten to publish exfiltrated data on the Tor network and, in some instances, have called victimized companies, according to FBI reporting.
**3.1.5 Encryption**
Akira threat actors utilize a sophisticated hybrid encryption scheme to lock data. This involves combining a ChaCha20 stream cipher with an RSA public-key cryptosystem for speed and secure key exchange [[T1486](https://attack.mitre.org/versions/v14/techniques/T1486/)]. This multilayered approach tailors encryption methods based on file type and size and is capable of full or partial encryption. Encrypted files are appended with either a .akira or .powerranges extension. To further inhibit system recovery, Akira’s encryptor (w.exe) utilizes PowerShell commands to delete volume shadow copies (VSS) on Windows systems [[T1490](https://attack.mitre.org/versions/v14/techniques/T1490)]. Additionally, a ransom note named fn.txt appears in both the root directory (C:) and each user’s home directory (C:\Users).
Trusted third party analysis identified that the Akira\_v2 encryptor is an upgrade from its previous version, which includes additional functionalities due to the language it’s written in (Rust). Previous versions of the encryptor provided options to insert arguments at runtime, including:
- -p --encryption\_path (targeted file/folder paths)
- -s --share\_file (targeted network drive path)
- -n --encryption\_percent (percentage of encryption)
- --fork (create a child process for encryption
The ability to insert additional threads allows Akira threat actors to have more granular control over the number of CPU cores in use, increasing the speed and efficiency of the encryption process. The new version also adds a layer of protection, utilizing the Build ID as a run condition to hinder dynamic analysis. The encryptor is unable to execute successfully without the unique Build ID. The ability to deploy against only virtual machines using “vmonly” and the ability to stop running virtual machines with “stopvm” functionalities have also been observed implemented for Akira\_v2. After encryption, the Linux ESXi variant may include the file extension “akiranew” or add a ransom note named “akiranew.txt” in directories where files were encrypted with the new nomenclature.
**3.1.6 Leveraged Tools**
Table 1 lists publicly available tools and applications Akira threat actors have used, including legitimate tools repurposed for their operations. Use of these tools and applications should not be attributed as malicious without analytical evidence to support threat actor use and/or control.
**Table 1: Tools Leveraged by Akira Ransomware Actors**
|  | --- | --- | **Name** | **Description** | [AdFind](https://attack.mitre.org/versions/v14/software/S0552/) | AdFind.exe is used to query and retrieve information from Active Directory. | Advanced IP Scanner | A network scanner is used to locate all the computers on a network and conduct a scan of their ports. The program shows all network devices, gives access to shared folders, and provides remote control of computers (via RDP and Radmin). | AnyDesk | [A common software that can be maliciously used by threat actors to obtain remote access and maintain persistence [T1219]. AnyDesk also supports remote file transfer.](https://attack.mitre.org/versions/v14/techniques/T1219) | [LaZagne](https://attack.mitre.org/software/S0349) | Allows users to recover stored passwords on Windows, Linux, and OSX systems. | PCHunter64 | A tool used to acquire detailed process and system information [T1082]. | [PowerShell](https://attack.mitre.org/versions/v14/techniques/T1059/001/) | A cross-platform task automation solution made up of a command line shell, a scripting language, and a configuration management framework, which runs on Windows, Linux, and macOS. | [Mimikatz](https://attack.mitre.org/versions/v14/software/S0002/) | Allows users to view and save authentication credentials such as Kerberos tickets. | [Ngrok](https://attack.mitre.org/versions/v14/software/S0508/) | [A reverse proxy tool [T1090] used to create a secure tunnel to servers behind firewalls or local machines without a public IP address.](https://attack.mitre.org/versions/v14/techniques/T1090/) | [RClone](https://attack.mitre.org/software/S1040) | [A command line program used to sync files with cloud storage services [T1567.002] such as Mega.](https://attack.mitre.org/versions/v14/techniques/T1567/002/) | SoftPerfect | A network scanner (netscan.exe) used to ping computers, scan ports, discover shared folders, and retrieve information about network devices via Windows Management Instrumentation (WMI), Simple Network Management Protocol (SNMP), HTTP, Secure Shell (SSH) and PowerShell. It also scans for remote services, registry, files, and performance counters. | WinRAR | [Used to split compromised data into segments and to compress [T1560.001] files into .RAR format for exfiltration.](https://attack.mitre.org/versions/v14/techniques/T1560/001/) | WinSCP | [Windows Secure Copy is a free and open source SSH File Transfer Protocol, File Transfer Protocol, WebDAV, Amazon S3, and secure copy protocol client. Akira threat actors have used it to transfer data [T1048] from a compromised network to actor-controlled accounts.](https://attack.mitre.org/versions/v14/techniques/T1048/) |
**4.0 Indicators of Compromise (IOCs)Disclaimer:** Investigation or vetting of these indicators is recommended prior to taking action, such as blocking.
**Table 2a: Malicious Files Affiliated with Akira Ransomware**
|  |
| --- | --- | --- | **File Name** | **Hash (SHA-256)** | **Description** | w.exe | d2fd0654710c27dcf37b6c1437880020824e161dd0bf28e3a133ed777242a0ca | Akira ransomware | Win.exe | dcfa2800754e5722acf94987bb03e814edcb9acebda37df6da1987bf48e5b05e | Akira ransomware encryptor | AnyDesk.exe | bc747e3bf7b6e02c09f3d18bdd0e64eef62b940b2f16c9c72e647eec85cf0138 | Remote desktop application | Gcapi.dll | 73170761d6776c0debacfbbc61b6988cb8270a20174bf5c049768a264bb8ffaf | DLL file that assists with the execution of AnyDesk.exe | Sysmon.exe | 1b60097bf1ccb15a952e5bcc3522cf5c162da68c381a76abc2d5985659e4d386 | Ngrok tool for persistence | Config.yml | Varies by use | Ngrok configuration file | Rclone.exe | aaa647327ba5b855bedea8e889b3fafdc05a6ca75d1cfd98869432006d6fecc9 | Exfiltration tool | Winscp.rnd | 7d6959bb7a9482e1caa83b16ee01103d982d47c70c72fdd03708e2b7f4c552c4 | Network file transfer program | WinSCP-6.1.2-Setup.exe | 36cc31f0ab65b745f25c7e785df9e72d1c8919d35a1d7bd4ce8050c8c068b13c | Network file transfer program | Akira\_v2 | 3298d203c2acb68c474e5fdad8379181890b4403d6491c523c13730129be3f75 | Akira\_v2 ransomware | 0ee1d284ed663073872012c7bde7fac5ca1121403f1a5d2d5411317df282796c | Megazord | ffd9f58e5fe8502249c67cad0123ceeeaa6e9f69b4ec9f9e21511809849eb8fc | Akira “Megazord” ransomware | dfe6fddc67bdc93b9947430b966da2877fda094edf3e21e6f0ba98a84bc53198 | 131da83b521f610819141d5c740313ce46578374abb22ef504a7593955a65f07 | 9f393516edf6b8e011df6ee991758480c5b99a0efbfd68347786061f0e04426c | 9585af44c3ff8fd921c713680b0c2b3bbc9d56add848ed62164f7c9b9f23d065 | 2f629395fdfa11e713ea8bf11d40f6f240acf2f5fcf9a2ac50b6f7fbc7521c83 | 7f731cc11f8e4d249142e99a44b9da7a48505ce32c4ee4881041beeddb3760be |
**Table 2b: Malicious Files Affiliated with Akira Ransomware**
|  |
| --- | --- | --- | **File Name** | **Hash (MD5)** | **Description** | winrar-x64-623.exe | 7a647af3c112ad805296a22b2a276e7c | Network file transfer program |
**Table 3a: Commands Affiliated with Akira Ransomware**
| --- | **Persistence and Discovery** | [nltest /dclist: [T1018]](https://attack.mitre.org/versions/v14/techniques/T1018/) | [nltest /DOMAIN\_TRUSTS [T1482]](https://attack.mitre.org/versions/v14/techniques/T1482/) | [net group “Domain admins” /dom [T1069.002]](https://attack.mitre.org/versions/v14/techniques/T1069/002/) | [net localgroup “Administrators” /dom [T1069.001]](https://attack.mitre.org/versions/v14/techniques/T1069/001/) | [tasklist [T1057]](https://attack.mitre.org/versions/v14/techniques/T1057/) | [rundll32.exe c:\Windows\System32\comsvcs.dll, MiniDump ((Get-Process lsass).Id) C:\windows\temp\lsass.dmp full [T1003.001]](https://attack.mitre.org/versions/v14/techniques/T1003/001/) |
**Table 3b: Commands Affiliated with Akira Ransomware**
| --- | **Credential Access** | cmd.exe /Q /c esentutl.exe /y | C:\Users\<username>\AppData\Roaming\Mozilla\Firefox\Profiles\<firefox\_profile\_id>.default-release\key4.db /d | C:\Users\<username>\AppData\Roaming\Mozilla\Firefox\Profiles\<firefox\_profile\_id>.default-release\key4.db.tmp” |
**Note:**Used for accessing Firefox data.
**Table 3c: Commands Affiliated with Akira Ransomware**
| --- | **Impact** | [powershell.exe -Command "Get-WmiObject Win32\_Shadowcopy | Remove-WmiObject" [T1490]](https://attack.mitre.org/versions/v14/techniques/T1490/) |
**5.0 Recommendation**
CyberSecurity Malaysia recommends system administrators review this advisory and take the below-recommended mitigations for immediate protection against the impact of Akira and other ransomware incidents. 
**5.1 Recommendations for System Administrators:**
1. Organisations must proactively monitor and screen for compromised credentials potentially due to Akira's infection. Akira could be part of a bigger attack like ransomware. Hence, compromised credentials must be immediately rectified by changing the passwords to strong passwords.
2. Implementing password revocation to enforce password changing.
3. Encourage employees to use secure password managers and longer passphrases, avoid using the same password for multiple accounts and set reminders to change passwords after several months.
4. Use multi-factor authentication to identify and protect the businesses' critical assets and access to critical information systems.
5. Restrict access authorisations according to user roles and develop authorisation policy to secure idle accounts; automatically lock accounts and alert IT staff after several failed login attempts.
6. Review Active Directory (AD) to locate and close existing backdoors such as compromised service accounts, which often have administrative privileges and are often targeted by attackers who aim to steal credentials.
7. Update security patches and antivirus software regularly.
8. Perform Data backups daily and test regularly. Place backup copies in a remote location.
9. Conduct IS awareness training for all staff at least once a year.
10. Do not download suspicious files from an unknown sender.
11. Conduct Disaster Recovery Plan review and update, if necessary.
12. Conduct Business Continuity Plan review and update, if necessary.
**5.2 Recommendations for Internet Users:**
1. Users should use strong and unique passwords.
2. Users should use secure passwords  for the network.
3. Users should be wary of phishing attempts and must not simply click on any links or executables they receive via social media and other messaging applications.
4. Users should practice safe browsing and backup data regularly.
5. Users should download software or applications from reputable sources.
6. Users should be wary and suspicious of applications circulated on social media for downloads.
7. Enable and use up-to-date anti-virus software.
8. Do regular security updates and patches.
9. Contact relevant authorities such as CyberSecurity Malaysia for inquiries and assistance 
10. Users are also encouraged to report to the Service Providers or the social media platform concerning the circulation of posts or ads with suspicious links.
Generally, CyberSecurity Malaysia advises the users of these devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
To report an incident and for further enquiries, please contact the Cyber999 Incident Response Centre through the following channels:
E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours)  
Mobile: +60 19 2665850 (24x7 call incident reporting) 
Business Hours: Mon - Fri 08:30 -17:30 MYT 
Web: [https://www.mycert.org.my](https://www.mycert.org.my/) 
**6.0 References**
- <https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-109a>
- <https://www.mycert.org.my/portal/advisory?id=MA-1034.022024>