Akira Ransomware
Recovery Services

Alvaka’s Akira Ransomware Recovery Services are designed to help companies to recover from ransomware attacks and to protect systems from any future attacks.
Learn more

Is there an Akira decryption key available?

Search the No More Ransomware Decryption Tools webpage to find out if there is a decryptor for Akira Ransomware.

What is Akira Ransomware?

Emerging in March 2023, Akira Ransomware quickly rose to infamy with its distinctive 1980s-themed website and substantial ransom demands, ranging from $200,000 to $4 million. The group targets numerous sectors, notably healthcare, finance, real estate, and manufacturing, and has thus far claimed over 60 victims. Akira is recognized for its ability to target both Windows and Linux systems and has been noted for potential affiliations with the notorious Conti ransomware group, given overlaps in their code and cryptocurrency wallets.

How Does Akira Ransomware Operate?

Akira ransomware actors deploy a variety of tactics to penetrate networks. These methods encompass:

Exploiting vulnerabilities in virtual private networks (VPNs), especially targeting Cisco VPN products.
Distributing phishing emails.
Disguised as trojans.
Conducting drive-by download attacks.

Upon a successful breach, Akira employs the double-extortion strategy, exfiltrating data prior to encryption. Victims are presented with a ransom note, characterized by grammatical errors. The group promises victims an entire security audit report, detailing the vulnerabilities exploited in their network.

Akira & Cisco VPN Exploits

Recently, Akira has been detected leveraging a zero-day in Cisco’s Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) software. This exploitation focuses on the remote access VPN feature, allowing the ransomware to potentially bypass VPNs without multi-factor authentication (MFA). Although the vulnerability is rated with a medium severity (CVSS score of 5.0), it signifies a major concern for organizations relying on Cisco products for remote connectivity.

In August 2023, Cisco ascertained that the vulnerability was actively exploited in Akira attacks. Organizations without MFA enabled on their Cisco VPNs were at particular risk, as the ransomware could breach corporate networks without requiring additional mechanisms or persistence.

Mitigating Akira Ransomware

Protecting your organization from Akira Ransomware necessitates a holistic cybersecurity approach. Recommended measures include:

Instituting a robust password policy.
Educating and training users about phishing and other cyber threats.
Activating multi-factor authentication.
Regularly updating and patching systems.
Instituting account lockout policies against brute force attacks.
Developing a comprehensive recovery and incident response plan.
Implementing network segmentation.

Being proactive, maintaining awareness of emerging threats, and addressing known vulnerabilities are imperative steps in ensuring organizational cybersecurity.