Akira (ransomware)

Akira (ransomware) is a malware which emerged in March 2023.^[1] It targeted over 250 entities including: US energy firm BHI Energy,^[2] Nissan Australia,^[3]^[4] the Finnish IT services provider Tietoevry,^[5]^[6]^[7]^[8] and Stanford University.^[9]^[10] The group has also claimed responsibility for a ransomware attack on the Toronto Zoo, though the zoo has not linked the incident to any particular threat actor.^[11] Akira is offered as ransomware-as-a-service. ^[12]

Akira is estimated to have earned up to $42 million from it's inception in March 2023, until April 2024.^[13]

Methods

Akira primarily targets Cisco VPN products as an attack vector to breach networks, especially those without multi-factor authentication enabled^[14].^[15] The group uses publicly available or natively installed tools and techniques for lateral movement. There are both Windows and Linux variants of Akira ransomware.

Akira uses double-extortion ransomware techniques, in which data is exfiltrated from the environment before it is encrypted with threats to publish this data if a ransom is not paid.^[16]

Akira v2

Akira v2 is written in Rust and is designed to locate files based on specific parameters, tailoring encryption to more specific file types.^[17] These file types are often associated with database project files, optical media, Exchange mailbox databases, virtual hard disks, and other file types associated with virtualization and virtual machines.

Key Generation

Akira used CryptGenRandom to generate a symmetric key, which itself was then encrypted by the combination of a ChaCha20 stream cipher and an RSA-4096 public key, which was appended to the end of encrypted files.^[1] The threat actors possessed the private key, preventing decryption without paying a ransom.

Akira ransomware has both a Windows and Linux version, though the Windows version uses the Windows CryptoAPI library while the Linux varient uses the Crypto++ library to encrypt devices when the ransomware is deployed.

Decryptor

In June of 2023, Avast released a decryptor for the Akira ransomware, likely exploiting the partial file encryption approach used at the time to crack the encryption without obtaining any keys.^[18] The decryptor does not work natively on Linux systems, and if needed it is recommended to use a WINE layer to run the decryptor on a Linux machine.

References