TF-MAL-py.akira_stealer
📛 Threat Title
Malware family: Akira Stealer
Description
ThreatFox malware family `py.akira_stealer`. Printable name: Akira Stealer.
Indicators of Compromise (0)
No indicators of compromise on this threat.
References (1)
- ThreatFox: IOCs for this family ThreatFox Malwares
Remediations (10)
-
web:attack.mitre.org
Akira ransomware, written in C++, is most prominently (but not exclusively) associated with the ransomware-as-a-service entity Akira . Akira ransomware has been used in attacks across North America, Europe, and Australia, with a focus on critical infrastructure sectors including manufacturing, education, and IT services.
-
web:cybelangel.com
Akira malware only takes around 2 hours to steal data: It's been found that the Akira gang can run " lightning-fast data exfiltration " from Veeam servers. It's already claimed tens of millions: Akira generated $42 million in ransomware payments between March 2023 and April 2024 alone—and the number is likely to be much higher now.
-
web:cybernews.com
The Akira ransomware group has updated its arsenal, introduced the new Akira_v2 variant, and has extorted nearly $244.17 million by late September 2025.
-
web:purple-ops.io
Establish a Reporting System: Create a system for employees to report suspicious activity to the IT security team. PurpleOps and Mitigation of Akira Ransomware PurpleOps provides a suite of cybersecurity services designed to help organizations mitigate the risks associated with ransomware attacks, including those perpetrated by the Akira group.
-
web:westoahu.hawaii.edu
Mitigation The Health Sector Cybersecurity Coordination Center recommends a variety of mitigation strategies. One of the most effective mitigation strategies which could have been used for the Akira malware would be to enable multi-factor authentication, namely for VPNs [6].
-
web:www.cisa.gov
Akira ransomware threat actors are associated with other groups known as Storm-1567, Howling Scorpius, Punk Spider, and Gold Sahara, and may have connections to the defunct Conti ransomware group. Akira threat actors primarily target small- and medium-sized businesses, but have also impacted larger organizations across various sectors.
-
web:www.fbi.gov
Actions for Organizations to Take Today to Mitigate Cyber Threats Related to Akira Ransomware Activity Prioritize remediating known exploited vulnerabilities.
-
web:www.ic3.gov
SUMMARY Note: This joint Cybersecurity Advisory (CSA) is part of an ongoing #StopRansomware effort to publish advisories for network defenders that detail various ransomware variants and ransomware threat actors. These #StopRansomware advisories include recently and historically observed tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) to help organizations ...
-
web:www.picussecurity.com
Learn how Akira ransomware operates in 2025 with updated CISA findings. Explore its latest TTPs, initial access methods, and actionable defense strategies.
-
web:www.sentinelone.com
Akira Ransomware is known for its retro aesthetic that's applied to its DLS. Learn about its multi-extortion tactics, negotiation processes, and mitigation techniques.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.