{"id":21973,"date":"2023-05-11T09:46:25","date_gmt":"2023-05-11T17:46:25","guid":{"rendered":"https:\/\/www.palada.net\/index.php\/2023\/05\/11\/news-15704\/"},"modified":"2023-05-11T09:46:25","modified_gmt":"2023-05-11T17:46:25","slug":"news-15704","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2023\/05\/11\/news-15704\/","title":{"rendered":"Akira Ransomware is \u201cbringin\u2019 1988 back\u201d"},"content":{"rendered":"

Credit to Author: gallagherseanm| Date: Tue, 09 May 2023 20:27:03 +0000<\/strong><\/p>\n

\n

On April 6, 2023, the Sophos Incident Response team was engaged to support a ransomware victim organization in North America. The following week on April 12, 2023, yet another North American organization contacted Sophos for assistance.<\/p>\n

While the incidents appeared to be the work of two different criminal actors, both deployed a recently emerged ransomware called Akira. In both cases, the affected organizations had files encrypted with the \u201c.akira\u201d extensions and had nearly identical ransom note files, named fn.txt, dropped in the process (as shown below in Figure 1].<\/p>\n

\"\"<\/a><\/p>\n

Figure 1: “fn.txt\u201d ransomware notice<\/em><\/p>\n

This Akira ransomware bears no code similarity to a previous ransomware<\/a> strain with the same name that was active in 2017 and is likely unrelated. The new jQuery-based leak site (Figure 2), with its retro green colors, has garnered most of the attention, as it accepts commands instead of listing out information.<\/p>\n

This slideshow requires JavaScript.<\/p>\n

<\/div>\n

 <\/p>\n

However, cool as their leak site design may be, this matters none to victims of this ransomware, which regrettably includes a daycare service in Canada<\/a>. While the total number of victim organizations (Figure 3) are still relatively small in comparison to Lockbit or BlackCat\/APLHV, that is how all new ransomware families begin.<\/p>\n

\"Bar<\/a>
Figure 3: Timeline analysis of Akira victims<\/figcaption><\/figure>\n

 <\/p>\n

In this blog post, we will compare two separate incident attack flows, illustrating how different threat actors are deploying Akira ransomware. Please note that available data on the second incident is limited, but we are highlighting deviations between the two incidents. This information will provide organizations with detailed guidance on what they need to defend against to protect their businesses.<\/p>\n

<\/h1>\n

Attack Flow Details<\/strong><\/h2>\n

Initial Access<\/strong><\/h2>\n

Incident #1<\/strong><\/h3>\n

A user account purposedly configured to allow for Multi-Factor Authentication (MFA) bypass.<\/p>\n

[T1078 \u2013 Valid Accounts] [T1133 \u2013 External Remote Service]<\/p>\n