akira

T1078Valid Accounts

Utilizes compromised VPN credentials.

T1078.002Valid Accounts: Domain Accounts

Operators use obtained domain accounts for access.

T1133External Remote Services

Actors exploit CVE-2023-20269 remote service vulnerabilities.

T1190Exploit Public-Facing Application

Targets vulnerable CISCO devices via CVE-2023-20269.

T1047Windows Management Instrumentation

Actors may use WMI to continue the attack.

T1059Command and Scripting Interpreter

Accepts parameters for its routines such as "-n 10" (for encryption percentage) or "-s (filename)" (for shared folder encryption).

T1059.001Command and Scripting Interpreter: PowerShell

Operators use PowerShell to launch commands to continue operations.

T1059.002System Services: Service Execution

Akira ransomware uses service execution for persistence.

T1059.003Command and Scripting Interpreter: Windows Command Shell

Operators use CMD to launch commands to continue operations.

T1136.001Create Account: Local Account

Upon initial access, Akira operators create a local account on the compromised system.

T1136.002Create Account: Domain Account

Upon initial access, Akira operators create a domain account on the compromised system.

T1078.002Valid Accounts: Domain Accounts

Utilizes valid domain accounts for privilege escalation.

TA0004Privilege Escalation

Utilizes local domain accounts for privilege escalation.

T1027.001Obfuscated Files or Information: Binary Padding

[Akira](https://attack.mitre.org/groups/G1024) has used binary padding to obfuscate payloads.(Citation: Cisco Akira Ransomware OCT 2024)

T1036.005Masquerading: Match Legitimate Resource Name or Location

[Akira](https://attack.mitre.org/groups/G1024) has used legitimate names and locations for files to evade defenses.(Citation: Cisco Akira Ransomware OCT 2024)

T1112Modify Registry

Uses commands in its operation to modify registries.

T1562.001Impair Defenses: Disable or Modify Tools

Usage of PowerTool or a KillAV tool abusing the Zemana AntiMalware driver to terminate AV-related processes was observed.

T1003.001OS Credential Dumping: LSASS Memory

Uses Mimikatz, LaZagne, or a command line to dump LSASS from memory.

T1558Steal or Forge Kerberos Tickets

[Akira](https://attack.mitre.org/groups/G1024) have used scripts to dump Kerberos authentication credentials.(Citation: Cisco Akira Ransomware OCT 2024)

T1018Remote System Discovery

Uses Advanced IP Scanner and MASSCAN to discover remote systems.

T1082System Information Discovery

Uses PCHunter and SharpHound to collect system information.

T1482Domain Trust Discovery

[Akira](https://attack.mitre.org/groups/G1024) uses the built-in [Nltest](https://attack.mitre.org/software/S0359) utility or tools such as [AdFind](https://attack.mitre.org/software/S0552) to enumerate Active Directory trusts in victim environments.(Citation: Arctic Wolf Akira 2023)

TA0007Discovery

Uses AdFind, Windows net command, and nltest to collect domain information.

T1021.001Remote Services: Remote Desktop Protocol

Utilizes remote services for accessing accounts and machines through remote services.

T1570Lateral Tool Transfer

Uses RDP to move laterally within the victim's network.

T1213.002Data from Information Repositories: Sharepoint

[Akira](https://attack.mitre.org/groups/G1024) has accessed and downloaded information stored in SharePoint instances as part of data gathering and exfiltration activity.(Citation: Secureworks GOLD SAHARA)

T1560.001Archive Collected Data: Archive via Utility

Utilizes discovery to gather information for exfiltration.

T1048.003Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol

Utilizes FileZilla or WinSCP to exfiltrate stolen information via FTP.

T1567.002Exfiltration Over Web Service: Exfiltration to Cloud Storage

Uses RClone to exfiltrate stolen information via a web service.

T1219Remote Access Tools

[Akira](https://attack.mitre.org/groups/G1024) uses legitimate utilities such as AnyDesk and PuTTy for maintaining remote access to victim environments.(Citation: Secureworks GOLD SAHARA)(Citation: Arctic Wolf Akira 2023)

T1229Remote Access Software

Utilizes AnyDesk, Radmin, Cloudflare Tunnel, MobaXterm, RustDesk, or Ngrok to gain remote access on targeted systems.

T1486Data Encrypted for Impact

Akira ransomware is used to encrypt files.

T1490Inhibit System Recovery

Deletes shadow copies to inhibit recovery.

T1531Account Access Removal

[Akira](https://attack.mitre.org/groups/G1024) deletes administrator accounts in victim networks prior to encryption.(Citation: Secureworks GOLD SAHARA)

T1657Financial Theft

[Akira](https://attack.mitre.org/groups/G1024) engages in double-extortion ransomware, exfiltrating files then encrypting them, in order to prompt victims to pay a ransom.(Citation: BushidoToken Akira 2023)(Citation: CISA Akira Ransomware APR 2024)

T1685Disable or Modify Tools

[Akira](https://attack.mitre.org/groups/G1024) has disabled or modified security tools for defense evasion.(Citation: Cisco Akira Ransomware OCT 2024)