akira ransomware group
The Akira ransomware group is said to have emerged in March 2023, and there's much speculation about its ties to the former CONTI ransomware group. It's worth noting that with the end of CONTI's operation, several affiliates migrated to independent campaigns such as Royal, BlackBasta, and others. According to some reports, Akira affiliates also work with other ransomware operations, such as Snatch and BlackByte, as…
- Claims in 7 days
- 8
- Claims in 30 days
- 40
- Reported techniques
- 36
Listings on leak sites are claims by criminals. They are unverified and can be false. coldbraid shows counts here, not names.
Where it claims victims
| Country | Claims in 60 days |
|---|---|
| United States | 9 |
| Canada | 3 |
| Germany | 2 |
| France | 1 |
| Switzerland | 1 |
| South Korea | 1 |
| Netherlands | 1 |
| United Kingdom | 1 |
Sectors
| Sector | Claims in 60 days |
|---|---|
| Manufacturing | 10 |
| Retail & E-Commerce | 5 |
| Professional Services | 5 |
| Transportation | 3 |
| Technology | 3 |
| Financial Services | 3 |
| Energy & Utilities | 2 |
| Agriculture and Food Production | 2 |
Reported techniques
Valid AccountsReplication Through Removable MediaExternal Remote ServicesExploit Public-Facing ApplicationWindows Management InstrumentationCommand and Scripting InterpreterCreate AccountCreate or Modify System ProcessObfuscated Files or InformationMasqueradingOS Credential DumpingUnsecured CredentialsCredentials from Password StoresSteal or Forge Kerberos TicketsRemote System DiscoverySystem Owner/User DiscoverySystem Information DiscoveryFile and Directory DiscoveryAccount DiscoveryDomain Trust DiscoveryRemote ServicesLateral Tool TransferData from Local SystemData from Information RepositoriesArchive Collected DataExfiltration Over Alternative ProtocolExfiltration Over Web ServiceApplication Layer ProtocolRemote Access ToolsData Encrypted for ImpactService StopInhibit System RecoveryAccount Access RemovalFinancial TheftModify RegistryDisable or Modify Tools