Group Profile: Akira
Perfil del grupo ransomware segun BushidoUK Ransomware Vulnerability Matrix. Incluye vulnerabilidades conocidas, herramientas y TTPs asociadas.
Akira's Exploited Vulnerabilities
> [!NOTE]
> This is the list of vulnerabilities that have been observed during intrusions that lead to Akira ransomware deployment or data exfiltration and leaks published to Akira's Tor Site
Cisco
| Product | CVE(s) | Ransomware Group(s) | Source(s) |
|---|---|---|---|
| ASA & FTD | CVE-2023-20269 | Akira | <a href="https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-ravpn-auth-8LyfCkeC#fs" rel="noopener" target="_blank">cisco.com</a> |
| ASA & FTD | CVE-2023-20263 | Akira | <a href="https://blog.talosintelligence.com/akira-ransomware-continues-to-evolve/" rel="noopener" target="_blank">blog.talosintelligence.com</a> |
| ASA & FTD | CVE-2020-3259 | Akira | <a href="https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-109a" rel="noopener" target="_blank">cisa.gov</a> |
Fortinet
| Product | CVE(s) | Ransomware Group(s) | Source(s) |
|---|---|---|---|
| FortiOS | CVE-2022-40684 | Akira | <a href="https://stairwell.com/resources/akira-pulling-on-the-chains-of-ransomware/" rel="noopener" target="_blank">stairwell.com</a> |
| FortiOS | CVE-2019-6693 | Akira | <a href="https://stairwell.com/resources/akira-pulling-on-the-chains-of-ransomware/" rel="noopener" target="_blank">stairwell.com</a> |
| FortiClient | CVE-2023-48788 | Akira | <a href="https://blog.talosintelligence.com/akira-ransomware-continues-to-evolve/" rel="noopener" target="_blank">blog.talosintelligence.com</a> |
SonicWall
| Product | CVE(s) | Ransomware Group(s) | Source(s) |
|---|---|---|---|
| SonicOS SSL-VPN | CVE-2024-40766 | Akira | <a href="https://arcticwolf.com/resources/blog/arctic-wolf-observes-akira-ransomware-campaign-targeting-sonicwall-sslvpn-accounts/" rel="noopener" target="_blank">arcticwolf.com</a> |
Veeam
| Product | CVE(s) | Ransomware Group(s) | Source(s) |
|---|---|---|---|
| Backup & Replication | CVE-2024-40711 | Akira | <a href="https://infosec.exchange/@SophosXOps/113284564225476186" rel="noopener" target="_blank">@SophosXOps</a> |
| Backup & Replication | CVE-2023-27532 | Akira | <a href="https://news.sophos.com/en-us/2023/12/21/akira-again-the-ransomware-that-keeps-on-taking/" rel="noopener" target="_blank">sophos.com</a> |
VMware
| Product | CVE(s) | Ransomware Group(s) | Source(s) |
|---|---|---|---|
| ESXi | CVE-2024-37085 ("ESX Admins") | Akira | <a href="https://www.microsoft.com/en-us/security/blog/2024/07/29/ransomware-operators-exploit-esxi-hypervisor-vulnerability-for-mass-encryption/" rel="noopener" target="_blank">microsoft.com</a> |
| vSphere Client | CVE-2021-21972 | Akira | <a href="https://blog.qualys.com/vulnerabilities-threat-research/2024/10/02/threat-brief-understanding-akira-ransomware" rel="noopener" target="_blank">qualys.com</a> |
---
#### Sources
| Date Published | Report |
|---|---|
| 10 Oct 2024 | https://infosec.exchange/@SophosXOps/113284564225476186 |
| 2 Oct 2024 | https://blog.qualys.com/vulnerabilities-threat-research/2024/10/02/threat-brief-understanding-akira-ransomware |
| 6 Sept 2024 | https://arcticwolf.com/resources/blog/arctic-wolf-observes-akira-ransomware-campaign-targeting-sonicwall-sslvpn-accounts/ |
| 29 July 2024 | https://www.microsoft.com/en-us/security/blog/2024/07/29/ransomware-operators-exploit-esxi-hypervisor-vulnerability-for-mass-encryption/
| 18 April 2024 | https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-109a | | 21 Dec 2023 | https://news.sophos.com/en-us/2023/12/21/akira-again-the-ransomware-that-keeps-on-taking/ | | 6 Sept 2023 | https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-ravpn-auth-8LyfCkeC#fs | | 23 Aug 2023 | https://stairwell.com/resources/akira-pulling-on-the-chains-of-ransomware/ |