akira

T1078Valid Accounts

Utilizes compromised VPN credentials.

T1078.002Valid Accounts: Domain Accounts

Operators use obtained domain accounts for access.

T1133External Remote Services

Actors exploit CVE-2023-20269 remote service vulnerabilities.

T1190Exploit Public-Facing Application

Targets vulnerable CISCO devices via CVE-2023-20269.

T1047Windows Management Instrumentation

Actors may use WMI to continue the attack.

T1059Command and Scripting Interpreter

Accepts parameters for its routines such as "-n 10" (for encryption percentage) or "-s (filename)" (for shared folder encryption).

T1059.001Command and Scripting Interpreter: PowerShell

Operators use PowerShell to launch commands to continue operations.

T1059.002System Services: Service Execution

Akira ransomware uses service execution for persistence.

T1059.003Command and Scripting Interpreter: Windows Command Shell

Operators use CMD to launch commands to continue operations.

T1136.001Create Account: Local Account

Upon initial access, Akira operators create a local account on the compromised system.

T1136.002Create Account: Domain Account

Upon initial access, Akira operators create a domain account on the compromised system.

T1078.002Valid Accounts: Domain Accounts

Utilizes valid domain accounts for privilege escalation.

TA0004Privilege Escalation

Utilizes local domain accounts for privilege escalation.

T1112Modify Registry

Uses commands in its operation to modify registries.

T1562.001Impair Defenses: Disable or Modify Tools

Usage of PowerTool or a KillAV tool abusing the Zemana AntiMalware driver to terminate AV-related processes was observed.

T1003.001OS Credential Dumping: LSASS Memory

Uses Mimikatz, LaZagne, or a command line to dump LSASS from memory.

T1018Remote System Discovery

Uses Advanced IP Scanner and MASSCAN to discover remote systems.

T1082System Information Discovery

Uses PCHunter and SharpHound to collect system information.

TA0007Discovery

Uses AdFind, Windows net command, and nltest to collect domain information.

T1021.001Remote Services: Remote Desktop Protocol

Utilizes remote services for accessing accounts and machines through remote services.

T1570Lateral Tool Transfer

Uses RDP to move laterally within the victim's network.

T1560.001Archive Collected Data: Archive via Utility

Utilizes discovery to gather information for exfiltration.

T1048.003Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol

Utilizes FileZilla or WinSCP to exfiltrate stolen information via FTP.

T1567.002Exfiltration Over Web Service: Exfiltration to Cloud Storage

Uses RClone to exfiltrate stolen information via a web service.

T1229Remote Access Software

Utilizes AnyDesk, Radmin, Cloudflare Tunnel, MobaXterm, RustDesk, or Ngrok to gain remote access on targeted systems.

T1486Data Encrypted for Impact

Akira ransomware is used to encrypt files.

T1490Inhibit System Recovery

Deletes shadow copies to inhibit recovery.