Akira Ransomware Technical Analysis and MITRE ATTACK TTPs Latest

Analysis of Akira Ransomware and MITRE ATT&CK TTPs

Initial Access:

• T1078 Valid Accounts & T1133 External Remote Services: Akira ransomware actors obtain valid credentials through brute force attacks or Initial Access Brokers (IABs). These credentials are then used to access target networks via Remote Desktop Protocol (RDP) and Virtual Private Network (VPN) services, establishing both initial and persistent access.
• T1190 Exploit Public Facing Applications: Akira operators exploit known vulnerabilities in Cisco systems, such as CVE-2023-20269 (CVSS Score: 9.1) and CVE-2020-3259 (CVSS Score: 7.5), gaining initial access through unpatched Cisco ASA appliances.
• T1566 Phishing: Phishing emails containing malicious links or attachments are used by Akira operators to trick users into compromising their systems.

Execution:

• T1047 Windows Management Instrumentation: Akira deletes volume shadow copies via Windows Management Instrumentation (WMI) to obstruct file recovery.

  powershell.exe -Command "Get-WmiObject Win32_Shadowcopy | Remove-WmiObject"

• T1059.001 Command and Scripting Interpreter: PowerShell: Akira uses PowerShell scripts such as Veeam-Get-Creds to extract and decrypt credentials from Veeam servers and Kerberos TicketDumper to dump Kerberos tickets from the LSA cache.
• T1059.003 Command and Scripting Interpreter: Windows Command Shell: Commands used by Akira for system discovery include:

  // T1018 Remote System Discovery
  nltest /dclist:<domain_name>

  // T1057 Process Discovery
  tasklist

  // T1069 Permission Groups Discovery
  net group “Domain admins” /domain
  net localgroup “Administrators” /domain

  // T1482 Domain Trust Discovery
  nltest /domain_trusts

Persistence:

• T1136.002 Create Account: Domain Account: Akira creates new domain accounts to maintain access, occasionally naming these accounts with administrative privileges, such as itadm.

Defense Evasion:

• T1562.001 Impair Defenses: Disable or Modify Tools: Akira exploits the Zemana AntiMalware driver through PowerTool to disable antivirus software, employing the Bring Your Own Vulnerable Driver (BYOVD) technique.

Credential Access:

• T1003 OS Credential Dumping: Akira uses tools like Mimikatz and LaZagne to extract credentials from LSASS memory, using the following command:

  rundll32.exe c:\Windows\System32\comsvcs.dll, MiniDump ((Get-Process lsass).Id) C:\Windows\temp\lsass.dmp full

• T1555.003 Credentials from Password Stores: Credentials from Web Browsers: Credentials from browsers are extracted using commands that leverage esentutl.exe:

  // Dumping credentials from Google Chrome
  esentutl.exe /y “[Path_to_Chrome_Cred_Stores]\Login Data" /d "[Path_to_Chrome_Cred_Stores]\Login Data.tmp”

  // Dumping credentials from Mozilla Firefox
  esentutl.exe /y “[Path_to_Firefox_Cred_Stores]\key4.db" /d “[Path_to_Firefox_Cred_Stores]\key4.db.tmp”

Collection:

• T1560 Archive Collected Data: Akira segments and compresses stolen data using WinRAR before exfiltration for double extortion.

Command and Control (C2):

• T1090 Proxy: Ngrok is utilized to establish secure tunnels for data exfiltration.
• T1219 Remote Access Software: Akira employs various remote desktop tools, including AnyDesk, Cloudflare Tunnel, MobaXterm, Ngrok, and RustDesk, to access compromised systems.

Exfiltration:

• T1048 Exfiltration Over Alternative Protocol & T1537 Transfer Data to Cloud Account: Akira exfiltrates data using tools like FileZilla, WinSCP, and rclone over protocols such as FTP, SFTP, and through cloud services.

Impact:

• T1486 Data Encrypted for Impact: Akira encrypts files with payloads that use a hybrid encryption scheme combining the ChaCha20 stream cipher with RSA. Encrypted files receive extensions such as .akira, .powerranges, or .akiranew.
• T1490 Inhibit System Recovery: Akira uses the following command to delete volume shadow copies and hinder file recovery:

  powershell.exe -Command "Get-WmiObject Win32_Shadowcopy | Remove-WmiObject"

How Akira Decryptor Helps Simulate Akira Ransomware Attacks:

To effectively test the resilience of your security controls against Akira ransomware, simulating these attacks is crucial. The Akira Decryptor platform offers robust simulation capabilities to evaluate defenses against this.

The Akira Decryptor Threat Library includes:

Additionally, the Akira Decryptor Mitigation Library provides prevention signatures to address Akira ransomware and other variants. Validated signatures for Akira ransomware include:

Evaluate and enhance your security posture by simulating attacks with the Akira Decryptor platform. Start your trial today for comprehensive threat testing and mitigation.