OTX-6ac614ca291abbad48bc40de
info
📛 Threat Title
Akira Ransomware Attack Investigation
Description
In September, an organization experienced an Akira ransomware attack, with investigation revealing the threat actor's tactics and tools. The attacker gained access through Remote Desktop Protocol, subsequently disabling antivirus protections on the compromised endpoint. The adversary deployed Rclone for data exfiltration purposes and utilized a GOST tunneling tool to maintain persistence within the network. Following these preparatory activities, the ransomware payload was executed. Forensic analysis of the impacted endpoints enabled investigators to identify key indicators of compromise, including command and control infrastructure and malicious executables. The investigation uncovered specific file paths and SHA256 hashes associated with the ransomware binary and GOST tunnel executable, along with the C2 server IP address used for tunnel communications. Pulse contains 2 indicator(s) (IOCs). View on OTX to inspect.
Indicators of Compromise (2)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
hash_sha256
d00833318a04caa019c6f95dcb3598ad947d405010bfb2f3cbd04530a00bc3a4
IOC database
- Type
- hash_sha256
- Value
d00833318a04caa019c6f95dcb3598ad947d405010bfb2f3cbd04530a00bc3a4- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_sha256
1f1bb322591b6d27fd2946e373d7d2efc2f4e1e66818846060d391600b600fba
IOC database
- Type
- hash_sha256
- Value
1f1bb322591b6d27fd2946e373d7d2efc2f4e1e66818846060d391600b600fba- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (2)
-
OTX pulse
AlienVaulkt OTX
In September, an organization experienced an Akira ransomware attack, with investigation revealing the threat actor's tactics and tools. The attacker gained access through Remote Desktop Protocol, subsequently disabling antivirus protections on the compromised endpoint. The adversary deployed Rclone for data exfiltration purposes and utilized a GOST tunneling tool to maintain persistence within the network. Following these preparatory activities, the ransomware payload was executed. Forensic ana
- reference AlienVaulkt OTX
Remediations (10)
-
web:github.com
Akira Ransomware is a cybercriminal group and ransomware family first discovered in March 2023. Operating under a Ransomware -as-a-Service (RaaS) model, the group rapidly gained notoriety for its professional operations, double extortion tactics, and ability to attack both Windows and Linux/VMware ESXi systems.
-
web:securityarsenal.com
Akira ransomware now encrypts data in under an hour. Defenders must automate detection to counter accelerated cyber attacks .
-
web:www.adaptivesecurity.com
Akira ransomware explained with confirmed figures separated from attacker claims: the attack chain, named victims, decryptor status, and where the operation stands in 2026.
-
web:www.cisa.gov
Analysts first identified Akira threat actors deploying the Windows-specific "Megazord" ransomware , and further investigation revealed the threat actors concurrently deployed a second payload during the attack , later identified as a novel variant of the Akira ESXi encryptor, Akira_v2.
-
web:www.fbi.gov
The authoring organizations encourage organizations to implement the recommendations in the Mitigations section of this advisory to reduce the likelihood and impact of Akira ransomware incidents.
-
web:www.manageengine.com
Analyze Akira ransomware , its MITRE ATT&CK tactics, IOCs, attack chain, detection signals, and endpoint hardening recommendations.
-
web:www.picussecurity.com
On November 13, 2025, the Cybersecurity and Infrastructure Security Agency (CISA), together with the FBI, HHS, Europol, OFAC, NCSC-NL, and German authorities, released an updated joint advisory on Akira ransomware . The report highlights Akira's continued evolution since 2023 and details new variants, expanded targeting, and newly observed attack techniques. In this blog post, we break down ...
-
web:www.securityscientist.net
Everything security teams need to know about Akira ransomware : how it works, ESXi targeting, data exfiltration, key IOCs, and the mitigations that actually stop it.
-
web:www.sentinelone.com
Akira Ransomware uses multi-extortion tactics and a retro-styled leak site. Learn about its negotiation processes and how to mitigate it.
-
web:www.veeam.com
Akira ransomware has cemented its reputation as one of the most relentless and disruptive cyber threats affecting organizations today. Akira has held the number one spot for six straight quarters in Coveware by Veeam's case data, and in 2024, it was responsible for 14% of all ransomware incidents. While many ransomware groups tend to chase after big-ticket targets, Akira takes a different ...
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.