Akira Ransomware

How Does Akira Ransomware Work?

The Akira ransomware variant is distributed in various ways. Some known distribution mechanisms include infected email attachments and the exploitation of vulnerabilities in VPN endpoints. Once the Akira ransomware gains access to a system, it uses various means to conceal its presence. For example, the ransomware may work against endpoint security solutions and uses LOLBins — which “live off the land” by using built-in functionality on a computer to perform malicious actions — to increase the complexity of detecting and remediating the infection. The ransomware is also known to steal credentials from a system by dumping the LSASS process memory, providing it with additional access and privileges on the compromised system.

Like the Conti V2 ransomware — which was leaked — the malware uses CryptGenRandom and ChaCha 2008 for file encryption. Encrypted files can be identified by a .akira extension appended to their filenames. The malware also deletes shadow copies of files, preventing them from being used for data recovery. In some cases, the ransomware has also been observed to perform extortion-only attacks. These attacks skip the stage of data encryption and, instead, exfiltrate data and demand a ransom not to sell or leak it publicly. After the ransomware has encrypted and/or stolen data, it displays a ransom message. Akira is known for demanding large ransoms, often in the hundreds of millions of dollars.

How to Protect Against Akira Ransomware

Akira ransomware infections can be costly for a business in terms of decreased productivity, lost data, and the cost of ransoms and remediation. Some best practices that organizations can implement to reduce their risk of a successful ransomware attack include the following:

• Cybersecurity Awareness Training: Akira leverages phishing emails and compromised credentials to distribute their malware. Cybersecurity awareness training can reduce an organization’s exposure to these threats by teaching employees about security best practices and how to recognize common attack techniques.
• Anti-Ransomware Solutions: The data encryption and exfiltration that ransomware performs is unusual and a clear indicator of a ransomware attack. Anti-ransomware solutions can use these behavioral indicators and other factors to identify, block, and remediate infections by Akira and other ransomware.
• Data Backups: Crypto ransomware like Akira is designed to force a company to pay a ransom by encrypting its data and demanding payment for the decryption key. Data backups enable a company to recover encrypted data without paying the ransom demand.
• Patch Management: Akira commonly exploits vulnerabilities in VPN software to infiltrate a target environment. Promptly installing patches and updates enables a company to close these security gaps before they can be exploited by the ransomware group.
• Strong User Authentication: The Akira ransomware variant commonly targets VPNs that lack multi-factor authentication (MFA), making it easier for the attacker to exploit compromised credentials. Enforcing the use of MFA on corporate systems increases the difficulty for the ransomware group to infect systems with their malware.
• Network Segmentation: Ransomware often needs to move laterally across a corporate network from its initial infection point to a system with valuable data. Network segmentation makes this movement more detectable and preventable before sensitive data can be encrypted or stolen.