/// ACCESS GRANTED /// Akira Ransomware TTP

/// CORE METADATA

PRIMARY ROLE: Ransomware as a Service (RaaS) Operator

STATUS: ACTIVE / HIGH THREAT

MOTIVATION: Financial

TARGETS: Manufacturing, Education, Healthcare, IT, Public Health

USERNAMES: Akira Ransomware

/// DATASET: MOST POPULAR BREACHES & SALES LOG (2 records)

[Various Critical Infrastructure] Ongoing | Data: Encrypted data and extortion.. Context: $244M USD claimed in ransom proceeds as of late 2025..

[Nutanix AHV VM Targets] June 2025 | Data: Encrypted AHV VM disk files.. Context: Exploited SonicWall vulnerability (CVE-2024-40766) to expand capabilities beyond ESXi..

/// TTP MAPPING: MITRE ATT&CK FRAMEWORK

Tactic	MITRE ID	Technique Description	Defense Focus
[Credential Access]	T1003	OS Credential Dumping: Uses tools like Mimikatz and LaZagne to aid in privilege escalation and lateral movement.	LSASS Protection, Credential Guard
[Initial Access]	T1110	Brute Force: Gains access to VPN products (SonicWall) by stealing login credentials or exploiting vulnerabilities (CVE-2024-40766).	MFA on VPNs, Strong Password Policy, Prioritize Remediation of KEVs
[Defense Evasion]	T1562.001	Disable or Modify Tools: Attempts to uninstall EDR systems and abuses remote access tools (AnyDesk/LogMeIn) for persistence.	Tamper Protection, Security Monitoring of Remote Access Tools

/// WEAPONIZATION: KEY TOOLS & ARTIFACTS

Mimikatz [Credential Dumping] LaZagne [Credential Scraping] Akira Encryptor [Ransomware (C++/Rust variants)] AnyDesk/LogMeIn [Persistence/Remote Access]