Threat Overview

The cyber threat landscape continues to evolve, with emerging threats posing significant risks to organizations worldwide. The Akira ransomware, first identified in late 2023, has since grown into a major concern for global cybersecurity. This report summarizes the tactics, techniques, and procedures (TTPs) of Akira ransomware, along with recommended defenses.

Threat Actor Group

Akira ransomware is believed to be attributed to a Russian-based threat actor group, operating actively since early 2023. With several active strains, including v2 and Megazord, this group has engaged in a high volume of attacks over the past year.

Tactics, Techniques, and Procedures (TTPs)

The report highlights the following TTPs employed by Akira ransomware:

• Exploiting leaked credentials and domain controller weaknesses to gain initial access.
• Establishing persistence via registry keys and domain accounts.
• Moving laterally using created accounts and credential extraction tools like Mimikatz.
• Employing encoding and obfuscation techniques to evade debuggers.
• Removing volume shadow copies to inhibit recovery.
• Encrypting files and exfiltrating data using tools such as WinSCP and Rclone.

Recommended Defenses

To mitigate risks associated with Akira ransomware, organizations are advised to:

1. Backup & Recovery: Regularly backup critical systems, test backups, store them offline or in the cloud.
2. Network Protection: Enforce network segmentation to limit lateral movement and protect critical systems.
3. Patch Management: Regularly assess and deploy patches based on impact to organizational assets.
4. Email Security: Use email filtering solutions with attachment sandboxing for proactive identification of malicious emails.
5. Incident Response Plan: Have a plan in place for rapid response, including blocking IPs, stopping processes, or isolating hosts.
6. Endpoint Detection & Response (EDR): Deploy EDR/MDR technologies for active monitoring and automated responses to detected threats.
7. Operational Threat Intelligence: Utilize threat intelligence solutions like Bitdefender IntelliZone to gain insights into cyber threats and associated threat actors.
8. Secure Remote Access: Enforce multi-factor authentication (MFA) for all remote access points, use VPN or secure access gateway instead of exposing RDP directly.

Organizations should stay informed about Akira ransomware’s active strains and monitor their ecosystems for patterns of compromise to mitigate potential attacks effectively.