Akira

MITRE ATT&CK: G1024 View on attack.mitre.org

Aliases: GOLD SAHARA, PUNK SPIDER, Howling Scorpius, Akira

First seen
2023-03-01 00:00:00
Primary motivation
financial-gain
Sophistication
intermediate
Resource level
organization
Actor type
criminal
Related IoCs
335 (334 malicious)
Last IoC activity
2026-09-01 23:56:54
Profile updated
2026-07-07 12:13:18

Targeted industries: financial-services healthcare-and-pharmaceutical manufacturing technology-and-telecommunications

Context

Akira is a ransomware variant and ransomware deployment entity active since at least March 2023. Akira uses compromised credentials to access single-factor external access mechanisms such as VPNs for initial access, then various publicly-available tools and techniques for lateral movement. Akira operations are associated with "double extortion" ransomware activity, where data is exfiltrated from victim environments prior to encryption, with threats to publish files if a ransom is not paid. Technical analysis of Akira ransomware indicates variants capable of targeting Windows or VMWare ESXi hypervisors and multiple overlaps with Conti ransomware.

Recent IoC activity

334 malicious indicators in Maltiverse are attributed to Akira (G1024). The 20 most recently updated:

TypeIndicatorUpdatedSources
file sample 988776358d0e45a4907dc1f4906a916f1b3595a31fa44d8e04e563a32557eb42 2026-09-01 5
file sample 2026-08-30_d3d636486941e411942512a20fd5b152_akira_bashlite_lockbit_mirai_ngio... 2026-09-01 1
file sample 2026-05-21_db1d42421e41141175b3d14de1b5421f_akira_cobalt-strike_icedid_njrat_... 2026-08-29 2
file sample 2026-08-25_ad72928b3c9de784cb28a3094d5acf07_akira_cobalt-strike_icedid_njrat_... 2026-08-26 1
file sample 17c17bce513ecfe10ebbf4844bc673115481a9c47154e5db29321bf3defb4778 2026-08-26 1
file sample 2026-08-21_59a9c664ae0c48ac7f09b261b2f13a82_akira_cobalt-strike_icedid_njrat_... 2026-08-22 1
file sample 2c7aeac07ce7f03b74952e0e243bd52f2bfa60fadc92dd71a6a1fee2d14cdd77 2026-08-19 6
file sample 2026-06-04_8413649372db28ac43fb3150e2df1120_akira_cobalt-strike_elex_emotet_i... 2026-08-14 1
file sample 8682a3be4761c0afea5da163ee1b99ddaa2f3b969c0f8f4df3aab9363e5fa1a1 2026-08-12 1
file sample 8e00a1bf1379705e78f8f9d71bd10e9f17aba0590c96418fc2048f72e322ad1a 2026-08-12 1
file sample 5aba768a8442a0126eaa4cd0d262f341faeb75ef145f8a75abc8a100ba3dfe48 2026-08-12 1
file sample 162af2443225be26024ff183357eaa9bc1e12ca8b14a23048c79355c183c0968 2026-08-12 1
file sample ceb2c128caf49dcd6c35c8d606d81a26534c63c9a0fd4024242bd56bbc9a6c96 2026-08-12 1
file sample 44e589fbaf434fa781bd4ea3a7e0203c1c876e27b5f5459ee74e7f0e9d1fbde6 2026-08-12 1
file sample ce290b03b929582da9d97f7dbc80c9cdb916212d8bd22e2658809c3235ab9d18 2026-08-12 1
file sample ef7789fd11c3e53b35b7782c6788045cfa9ae17b8cdf8309c98adc0fe7d70d8a 2026-08-12 1
file sample 13fb92e2a0fc7c26d395cfc25c3a50cd1a80327cfe19ab3347097a31afa8ae61 2026-08-12 1
file sample fc617f4d70c0178c290bf18b50d9164ec92264b965abeab6dfb14108ab1a9e38 2026-08-12 1
file sample 63389a887bd8e2fe4d7dbbef72e8819f19c533f97cbb073b8d248725a092275d 2026-08-12 1
file sample 9fc40a0a48f17dfaba710b0fbdc21c65c55a6f0eceb3aea53efd7e14f7a0a7e7 2026-08-12 1

Detection coverage

  • 15 YARA rules
  • 529 Sigma rules

Malware & tools used

  • Exfiltration to Cloud Storage (attack-pattern)
  • Sharepoint (attack-pattern)
  • Account Access Removal (attack-pattern)
  • Domain Trust Discovery (attack-pattern)
  • Match Legitimate Resource Name or Location (attack-pattern)
  • Valid Accounts (attack-pattern)
  • Steal or Forge Kerberos Tickets (attack-pattern)
  • Remote System Discovery (attack-pattern)
  • Remote Desktop Protocol (attack-pattern)
  • PowerShell (attack-pattern)
  • Financial Theft (attack-pattern)
  • Data Encrypted for Impact (attack-pattern)
  • External Remote Services (attack-pattern)
  • Binary Padding (attack-pattern)
  • Disable or Modify Tools (attack-pattern)
  • Remote Access Tools (attack-pattern)
  • Archive via Utility (attack-pattern)
  • Megazord (malware)
  • Rclone (malware)
  • Akira (malware)
  • Akira _v2 (malware)
  • Mimikatz (malware)
  • LaZagne (malware)
  • AdFind (malware)
  • PsExec (malware)

Related threat objects

Reports & references

  • news.sophos.com — Cryptoguard An Asymmetric Approach To The Ransomware Battle (report)
  • Kaspersky — 111483 (report)
  • trellix.com — Akira Ransomware (report)
  • blog.sekoia.io — Sekoia Io Mid 2023 Ransomware Threat Landscape (report)
  • decoded.avast.io — Avast Q2 2023 Threat Report (report)
  • arcticwolf.com — Conti And Akira Chained Together (report)
  • MITRE ATT&CK — G1024 (report)
  • blog.bushidotoken.net — Tracking Adversaries Akira Another (report)
  • Cisco Talos — Akira Ransomware Continues To Evolve (report)
  • Palo Alto Unit 42 — Threat Assessment Howling Scorpius Akira Ransomware (report)
  • CISA — Aa24 109A Stopransomware Akira Ransomware 2 (report)
  • CrowdStrike — Punk Spider (report)
  • secureworks.com — Gold Sahara (report)

External references