Emulating the Deceptive Akira Ransomware – Source: securityboulevard.com

Akira is a ransomware strain operated under the Ransomware-as-a-Service (RaaS) model, enabling multiple adversaries to deploy it in exchange for a share of the proceeds from successful compromises. It emerged in March 2023 and is reportedly unrelated to a previous ransomware strain of the same name that was active in 2017, despite both appending the .akira extension to encrypted files.

According to a report published by the Arctic Wolf Labs Team in July 2023, Akira has been linked to Conti ransomware due to code similarities, including string obfuscation, file encryption routines, and the exclusion of specific file extensions. The report states that when Conti’s source code was leaked, multiple adversaries repurposed it to develop or tweak their ransomware code, rendering it even more challenging to trace ransomware families back to Conti’s operators.

Akira’s operators manage a TOR-based Dedicated Leak Site (DLS) (.onion domain), where victims are instructed to use a unique identifier from the ransom message to identify themselves and initiate negotiations. If ransom demands are not met, the group will use this leak site to list victims and any stolen information, as Akira exfiltrates sensitive information before encrypting files and devices. According to reports, Akira operators provide victims the option to pay for either file decryption or data deletion rather than being forced to pay for both. Reported ransom demands range from 200,000 USD to over 4 million USD.

AttackIQ previously emulated the Akira ransomware with an emulation released on April 22, 2024, in response to CISA Advisory AA24-109A. This emulation has since been updated to incorporate newly observed behaviors associated with Akira ransomware.

AttackIQ has released a new attack graph composed the several Tactics, Techniques and Procedures (TTPs) exhibited by Akira ransomware during its most recent activities with the aim of helping customers validate their security controls and their ability to defend against this sophisticated and recent threat.

Validating your security program performance against these behaviors is vital in reducing risk. By using this new assessment template in the AttackIQ Security Optimization Platform, security teams will be able to:

• Evaluate security control performance against baseline behaviors associated with the Akira ransomware.
• Assess their security posture against an opportunistic adversary, which does not discriminate when it comes to selecting its targets.
• Continuously validate detection and prevention pipelines against a playbook similar to those of many of the groups currently focused on ransomware activities.

[Malware Emulation] Akira Ransomware – 2024-12- Associated Tactics, Techniques and Procedures (TTPs)

This emulation replicates the sequence of behaviors associated with the deployment of Akira ransomware on a compromised system with the intent of providing customers with the opportunity to detect and/or prevent a compromise in progress.

The assessment template is based on behaviors reported by Palo Alto Networks on December 2, 2024, Hybrid Analysis on January 13, 2024, and Joe Sandbox on February 6, 2025.

Discovery – Local System Reconnaissance

This stage begins with the deployment of Akira ransomware which, once operational, will perform reconnaissance of the environment, seeking to obtain information about the underlying hardware, operating system version and the Globally Unique Identifier (GUID) of the system.

Ingress Tool Transfer (T1105): This scenario downloads to memory and saves to disk in independent scenarios to test network and endpoint controls and their ability to prevent the delivery of known malicious samples.

System Information Discovery (T1082): This scenario executes the GetSystemInfo Native API call to retrieve information associated to the system.

System Information Discovery (T1082): This scenario executes RtlGetVersion and NetWkstaGetInfo Windows API calls to enumerate system information.

Query Registry (T1012): This scenario queries the MachineGUID value located within the HKLMSOFTWAREMicrosoftCryptography registry key which contains the unique identifier of the system.

Discovery & Impact – Akira Ransomware File Encryption

Inhibit System Recovery (T1490): This scenario executes the Get-WMIObject Win32_ShadowCopy PowerShell command to delete a Volume Shadow Copy created by the assessment template.

System Information Discovery (T1082): This scenario executes the GetLogicalDriveStringsW Windows API call to retrieve information regarding the system’s physical drives.

System Information Discovery (T1082): This scenario executes the GetDriveTypeW Windows API call to retrieve information regarding the system’s physical drives.

File and Directory Discovery (T1083): This scenario executes the FindFirstFileW and FindNextFileW Windows API calls to perform the enumeration of the file system.

Data Encrypted for Impact (T1486): This scenario performs the file encryption routines used by common ransomware families. Files matching an extension list are identified and encrypted in place using similar encryption algorithms as used by Akira ransomware.

Detection and Mitigation Opportunities

Given the number of different techniques being utilized by this threat, it can be difficult to know which to prioritize for prevention and detection opportunities. AttackIQ recommends first focusing on the following techniques emulated in our scenarios before moving on to the remaining techniques.

1. Ingress Tool Transfer (T1105):

This actor relies heavily in downloading additional stages of malware. Endpoint and Network security controls should both be employed to try and detect the delivery of these malicious payloads.

1a. Detection

The following signatures can help identify when native utilities are being used to download malicious payloads.

PowerShell Example:

Process Name == (Cmd.exe OR Powershell.exe)
Command Line CONTAINS ((“IWR” OR “Invoke-WebRequest") AND “DownloadData” AND “Hidden”)

1b. Mitigation

MITRE ATT&CK has the following mitigation recommendations.

• M1031 – Network Intrusion Prevention

2. Inhibit System Recovery (T1490):

Adversaries often delete Volume Shadow Copies to prevent the possibility of restoring files back to their original state. This is a common technique used by ransomware as it prevents the recovery of files once the ransomware encryption routine successfully completes execution.

2a. Detection

Detecting deletion of Volume Shadow Copies is usually the first step that occurs and can be detected by looking at the command line activity

Process Name == powershell.exe
Command Line == “Get-WmiObject Win32_ShadowCopy | ForEach-Object ($_.Delete();)”

2b. Mitigation

MITRE ATT&CK has the following mitigation recommendations for Inhibit System Recovery

Wrap-up

In summary, this attack graph will evaluate security and incident response processes and support the improvement of your security control posture against the behaviors exhibited by Akira ransomware operators. With data generated from continuous testing and use of this assessment template, you can focus your teams on achieving key security outcomes, adjust your security controls, and work to elevate your total security program effectiveness against a known and dangerous threat.

AttackIQ, the leading provider of Adversarial Exposure Validation (AEV) solutions, is trusted by top organizations worldwide to validate security controls in real time. By emulating real-world adversary behavior, AttackIQ closes the gap between knowing about a vulnerability and understanding its true risk. AttackIQ’s AEV platform aligns with the Continuous Threat Exposure Management (CTEM) framework, enabling a structured, risk-based approach to ongoing security assessment and improvement. The company is committed to supporting its MSSP partners with a Flexible Preactive Partner Program that provides turn-key solutions, empowering them to elevate client security. AttackIQ is passionate about giving back to the cybersecurity community through its free award-winning AttackIQ Academy and founding research partnership with MITRE Center for Threat-Informed Defense.