Akira Ransomware Expands Extortion-Only Attacks via Unsecured VPN Access

Sophos reported that Akira has become a major threat to small and medium-sized organizations across Europe, North America, and Australia, hitting sectors including government, manufacturing, technology, education, consulting, pharmaceuticals, and telecommunications. The group commonly gained initial access through unauthorized logins to Cisco ASA SSL VPN and Cisco AnyConnect systems that lacked MFA, and in some cases exploited CVE-2023-20269 and Veeam CVE-2023-27532. Researchers said Akira operators routinely stole credentials, moved laterally, established persistence, and attempted to evade defenses before either encrypting systems or stealing data for extortion.

Sophos said Akira shifted notably toward extortion-only operations beginning in late 2023, exfiltrating data without always deploying ransomware. During intrusions, the actors dumped LSASS, extracted NTDS.dit and SYSTEM hives, targeted Veeam, browser, and KeePass credentials, and used tools including Mimikatz, AdFind, Advanced IP Scanner, RDP, SMB, wmiexec, PsExec, AnyDesk, WinRAR, rclone, and MEGA. The report also identified a previously unreported backdoor, crome.exe, communicating with 170.130.165[.]171, alongside repeated efforts to disable Sophos and Microsoft Defender protections. When encryption was used, Akira deployed binaries such as w.exe, Lck.exe, 1.exe, and locker.exe, appended the .akira extension, dropped akira_readme.txt, deleted Volume Shadow Copies, and in one case encrypted about 65,000 files on a server.