Akira

MITRE ATT&CK: G1024 View on attack.mitre.org

Aliases: GOLD SAHARA, PUNK SPIDER, Howling Scorpius, Akira

First seen
2023-03-01 00:00:00
Primary motivation
financial-gain
Sophistication
intermediate
Resource level
organization
Actor type
criminal
Related IoCs
341 (340 malicious)
Last IoC activity
2026-10-18 03:32:50
Profile updated
2026-07-07 12:13:18

Targeted industries: financial-services healthcare-and-pharmaceutical manufacturing technology-and-telecommunications

Context

Akira is a ransomware variant and ransomware deployment entity active since at least March 2023. Akira uses compromised credentials to access single-factor external access mechanisms such as VPNs for initial access, then various publicly-available tools and techniques for lateral movement. Akira operations are associated with "double extortion" ransomware activity, where data is exfiltrated from victim environments prior to encryption, with threats to publish files if a ransom is not paid. Technical analysis of Akira ransomware indicates variants capable of targeting Windows or VMWare ESXi hypervisors and multiple overlaps with Conti ransomware.

Recent IoC activity

340 malicious indicators in Maltiverse are attributed to Akira (G1024). The 20 most recently updated:

TypeIndicatorUpdatedSources
file sample ce290b03b929582da9d97f7dbc80c9cdb916212d8bd22e2658809c3235ab9d18 2026-10-18 1
file sample 2026-05-28_ec20bdb75f0d4ddd40f559795b4cda74_akira_cobalt-strike_icedid_njrat_... 2026-10-16 2
file sample 2026-08-25_ad72928b3c9de784cb28a3094d5acf07_akira_cobalt-strike_icedid_njrat_... 2026-10-12 1
file sample Akira Ransomware 2026-10-11 2
file sample 2026-09-05_671f80086f89db568e7c58d5f47f579d_akira_cobalt-strike_icedid_njrat_... 2026-10-10 1
file sample 2026-09-04_8c87465ef7c0c083e288b2894355bf07_akira_lockbit_revil 2026-10-10 1
file sample aa.elf 2026-10-10 4
file sample 2026-09-04_84eb72f62b2e6fcf3a526409bebedcc9_akira_lockbit_revil 2026-10-08 1
file sample 2026-08-30_d3d636486941e411942512a20fd5b152_akira_bashlite_lockbit_mirai_ngio... 2026-10-08 3
file sample bounty-79374517260041244 2026-10-06 2
file sample a091fb15074d114bcc16a3575c6053535356c3e8576e50e147b7cf3876d33267 2026-10-04 2
file sample 39e8cc7d47b69341908afda35046dbcccf118271918e69c4012dd35923b55c9f 2026-10-04 2
file sample Akira.exe.malware 2026-10-04 3
file sample b9c1e8700e39c6768be9d6bcb092cd6abe80d4244fc437566b58721cdc7d61ff 2026-10-03 3
URL https://github.com/topics/ransomware 2026-09-30 1
file sample bounty-38953738362456038 2026-09-28 2
file sample 0c8d5f2b94ca60616d0db69f31cf4a651ae816e44ef6f807851601c1a4e52d10 2026-09-26 1
file sample 2026-09-25_e218b8685c58080ff42dd0c8af154849_akira_cobalt-strike_icedid_njrat_... 2026-09-26 2
file sample akira_encryptor-310db4ae1c7dc6f3da03565b8338830428d293fa5511738e21280f18e02aca19.exe 2026-09-24 2
file sample 2026-08-05_fa11f152e232a3362556598c33b71def_akira_cobalt-strike_icedid_njrat_... 2026-09-23 1

Detection coverage

  • 15 YARA rules
  • 529 Sigma rules

Malware & tools used

  • Exfiltration to Cloud Storage (attack-pattern)
  • Sharepoint (attack-pattern)
  • Account Access Removal (attack-pattern)
  • Domain Trust Discovery (attack-pattern)
  • Match Legitimate Resource Name or Location (attack-pattern)
  • Valid Accounts (attack-pattern)
  • Steal or Forge Kerberos Tickets (attack-pattern)
  • Remote System Discovery (attack-pattern)
  • Remote Desktop Protocol (attack-pattern)
  • PowerShell (attack-pattern)
  • Financial Theft (attack-pattern)
  • Data Encrypted for Impact (attack-pattern)
  • External Remote Services (attack-pattern)
  • Binary Padding (attack-pattern)
  • Disable or Modify Tools (attack-pattern)
  • Remote Access Tools (attack-pattern)
  • Archive via Utility (attack-pattern)
  • Megazord (malware)
  • Rclone (malware)
  • Akira (malware)
  • Akira _v2 (malware)
  • Mimikatz (malware)
  • LaZagne (malware)
  • AdFind (malware)
  • PsExec (malware)

Related threat objects

Reports & references

  • arcticwolf.com — Conti And Akira Chained Together (report)
  • MITRE ATT&CK — G1024 (report)
  • blog.bushidotoken.net — Tracking Adversaries Akira Another (report)
  • Cisco Talos — Akira Ransomware Continues To Evolve (report)
  • Palo Alto Unit 42 — Threat Assessment Howling Scorpius Akira Ransomware (report)
  • CISA — Aa24 109A Stopransomware Akira Ransomware 2 (report)
  • CrowdStrike — Punk Spider (report)
  • secureworks.com — Gold Sahara (report)
  • decoded.avast.io — Avast Q2 2023 Threat Report (report)
  • news.sophos.com — Cryptoguard An Asymmetric Approach To The Ransomware Battle (report)
  • Kaspersky — 111483 (report)
  • trellix.com — Akira Ransomware (report)
  • blog.sekoia.io — Sekoia Io Mid 2023 Ransomware Threat Landscape (report)

External references