Akira Ransomware Hit North American Victims After VPN and MFA Bypass Intrusions

Sophos reported that newly emerged Akira ransomware was deployed in two separate April 2023 attacks against organizations in North America, with victims’ files renamed using the .akira extension and ransom notes dropped as fn.txt. The company said the strain appears unrelated to a 2017 ransomware family of the same name. In one intrusion, attackers gained access to an account through MFA bypass activity linked to TOR exit nodes, dumped LSASS memory via comsvcs.dll launched with rundll32.exe, moved laterally over RDP, tampered with Windows Defender, installed AnyDesk, and launched encryption after about seven days in the environment.

In the second case, attackers entered through single-factor VPN access, likely harvested credentials as indicated by MEMORY.DMP, conducted reconnaissance with Advanced IP Scanner and LANSweeper data, used Cloudflare Tunnel and Radmin for remote access, and staged data with WinRAR before deploying ransomware after more than 30 days. Sophos said Akira targeted a relatively narrow set of 26 file extensions, focusing largely on databases, virtual disks, and memory image files while avoiding some file types to preserve system stability, and noted that the slower pace of both operations created multiple opportunities for defenders to detect and disrupt the attacks before encryption.